coleam00/Archon · error

Checksum not found for ${filename} in checksums.txt

Error message

Checksum not found for ${filename} in checksums.txt

What it means

parseChecksum throws this when it finished scanning every line of the checksums.txt content without finding an entry whose filename column matches the requested file. It means the checksum manifest does not describe the artifact downloadWebDist wants to verify. The code fails closed rather than skipping verification.

Source

Thrown at packages/cli/src/commands/serve.ts:306

  throw new Error(message);
}

/**
 * Parse a SHA-256 checksum from a checksums.txt file (sha256sum format).
 * Format: `<hash>  <filename>` or `<hash> <filename>`
 */
export function parseChecksum(checksums: string, filename: string): string {
  for (const line of checksums.split('\n')) {
    const parts = line.trim().split(/\s+/);
    if (parts.length >= 2 && parts[1] === filename) {
      const hash = parts[0];
      if (!/^[0-9a-f]{64}$/.test(hash)) {
        throw new Error(`Malformed checksum entry for ${filename}: "${line.trim()}"`);
      }
      return hash;
    }
  }
  throw new Error(`Checksum not found for ${filename} in checksums.txt`);
}

View on GitHub (pinned to 0773b97458)

Solutions

1. Print the fetched checksums body — if it's HTML or empty, fix the checksums URL or network path (proxy/captive portal) first.
2. Ensure the checksums.txt and tarball come from the same release; fetch both fresh from the matching release tag.
3. Confirm the manifest line format `<sha256> <filename>` with the filename as the second whitespace-separated field.
4. If the asset was renamed upstream, update the CLI version to one requesting the current artifact name.

Example fix

// before
const text = await checksumsRes.text(); // 200 with HTML soft-404
const hash = parseChecksum(text, 'archon-web.tar.gz'); // throws not found
// after
const text = await checksumsRes.text();
if (!text.includes('archon-web.tar.gz')) {
  throw new Error(`checksums.txt body invalid (len=${text.length}), check URL`);
}
const hash = parseChecksum(text, 'archon-web.tar.gz');

const text = await (await fetch(checksumsUrl)).text();
const hasEntry = text
  .split('\n')
  .some((l) => l.trim().split(/\s+/)[1] === 'archon-web.tar.gz');
if (!hasEntry) {
  throw new Error(
    `checksums source at ${checksumsUrl} lacks an entry for archon-web.tar.gz ` +
    `(body starts with: ${JSON.stringify(text.slice(0, 60))})` // shows HTML/soft-404 immediately
  );
}

try {
  await serveCommand();
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Checksum not found for')) {
    // dump the manifest body: if it's HTML/empty, fix the URL or network;
    // if it's a real manifest, you fetched a release that names the artifact differently.
  } else throw err;
}

When it happens

Trigger: downloadWebDist -> parseChecksum(checksumsText, 'archon-web.tar.gz') iterates all lines and no line's second field equals 'archon-web.tar.gz': empty or HTML error-page body (fetch got a 200 with wrong content), manifest from a different release that names the artifact differently, or filename column separated by something the /\s+/ split doesn't treat as the second field.

Common situations: Download URL for checksums.txt pointing to a 200-OK HTML page (captive portal, soft-404); release renamed the asset; stale cached manifest from an older release; line endings or extra columns shifting the filename out of parts[1].

Related errors

• Malformed checksum entry for ${filename}: "${line.trim()}"
• Malformed embedded checksum: "${checksum}"
• No chat in context
• Gitea API error: ${String(response.status)} ${response.statu
• Gitea API error: ${String(response.status)}

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/e957bd77afd7ff0d. Report an issue: GitHub.