Network error fetching checksums from ${checksumsUrl}: ${toE

Error message

Network error fetching checksums from ${checksumsUrl}: ${toError(err).message}

What it means

The fallback (no embedded checksum) path of downloadWebDist fetches the checksums file and tarball in parallel; this error wraps any network-level failure of fetch(checksumsUrl), preserving the underlying message. It exists so the operator sees which URL failed rather than an opaque fetch rejection.

Source

Thrown at packages/cli/src/commands/serve.ts:140

  console.log(`Web UI not found locally — downloading from release v${version}...`);

  // Determine expected hash: prefer build-time embedded hash (independent trust anchor)
  // over the remote checksums.txt (same-source, weaker guarantee).
  let expectedHash: string;
  let tarballRes: Response;
  if (embeddedChecksum) {
    expectedHash = parseEmbeddedChecksum(embeddedChecksum);
    log.info({ source: 'embedded' }, 'web_dist.checksum_resolved');
    console.log(`Downloading ${tarballUrl}...`);
    tarballRes = await fetch(tarballUrl).catch((err: unknown) => {
      throw new Error(`Network error fetching tarball from ${tarballUrl}: ${toError(err).message}`);
    });
  } else {
    // Fallback: download checksums and tarball in parallel (dev mode or pre-build binaries)
    console.log(`Downloading ${tarballUrl}...`);
    const [checksumsRes, fetchedTarballRes] = await Promise.all([
      fetch(checksumsUrl).catch((err: unknown) => {
        throw new Error(
          `Network error fetching checksums from ${checksumsUrl}: ${toError(err).message}`
        );
      }),
      fetch(tarballUrl).catch((err: unknown) => {
        throw new Error(
          `Network error fetching tarball from ${tarballUrl}: ${toError(err).message}`
        );
      }),
    ]);
    if (!checksumsRes.ok) {
      throw new Error(
        `Failed to download checksums: ${checksumsRes.status} ${checksumsRes.statusText}`
      );
    }
    const checksumsText = await checksumsRes.text();
    expectedHash = parseChecksum(checksumsText, 'archon-web.tar.gz');
    log.info({ source: 'remote' }, 'web_dist.checksum_resolved');
    tarballRes = fetchedTarballRes;

View on GitHub (pinned to 0773b97458)

Solutions

Verify reachability of the checksums URL with curl -I <checksumsUrl> from the host.
Fix proxy/egress configuration (HTTPS_PROXY) or firewall rules for the download host.
Use a release binary with an embedded checksum to skip the remote checksums download entirely.
Retry on transient failures; confirm the release/channel actually publishes the checksums artifact.

Example fix

// before: dev binary hitting missing checksums host
archon serve --download  # fetch(checksumsUrl) fails
// after: release binary with embedded checksum
archon serve --download  # uses parseEmbeddedChecksum path

Defensive patterns

Strategy: retry

Validate before calling

const res = await fetch(checksumsUrl).catch(() => null);
if (!res || !res.ok) throw new Error(`Checksums URL unreachable or failing: ${checksumsUrl}`);

Try / catch

try {
  await serveCommand({ downloadOnly: true });
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Network error fetching checksums')) {
    // verify DNS/proxy for the checksums host and retry
  }
}

Prevention

Prefer release binaries with embedded checksums (single fetch path).
Ensure the release channel publishes the checksums artifact.
Set proxy env vars where egress goes through a corporate proxy.

When it happens

Trigger: serveCommand -> downloadWebDist in dev/pre-build mode (embeddedChecksum absent); fetch(checksumsUrl) rejects due to unreachable host, DNS/TLS failure, or aborted request.

Common situations: Same network issues as tarball fetch: offline host, proxy blocking, DNS failure; dev binaries pointing at a release URL that does not host checksums yet; firewall egress rules.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/1b3f20fd01b11a38. Report an issue: GitHub.