What causes "failed to get sha256 of %s: %w" in crowdsecurity/crowdsec?

Check the file exists and is readable at the reported path (ls -l ).

failed to get sha256 of %s: %w

Error message

failed to get sha256 of %s: %w

What it means

Returned by setVersionState when it cannot compute the SHA-256 digest of the downloaded/local item file. The wrap includes the file path and the underlying I/O error, and the item's version detection cannot proceed without the hash.

Source

Thrown at pkg/cwhub/sync.go:593

	for _, version := range sorted {
		if i.Versions[version].Digest == hash {
			return version, true, nil
		}
	}

	return "?", false, nil
}

func (i *Item) setVersionState(path string, inhub bool) error {
	var err error

	if !inhub {
		i.State.LocalPath = path
	}

	hash, err := downloader.SHA256(path)
	if err != nil {
		return fmt.Errorf("failed to get sha256 of %s: %w", path, err)
	}
	i.State.LocalHash = hash

	version, found, err := i.detectVersionFromHash(hash)
	if err != nil {
		return err
	}
	i.State.LocalVersion = version

	if !found {
		i.hub.logger.Tracef("got tainted match for %s: %s", i.Name, path)
		i.State.UpToDate = false
		i.addTaint(i)
		return nil
	}

	// we got an exact match, update struct

View on GitHub (pinned to 909b515798)

Solutions

Check the file exists and is readable at the reported path (ls -l <path>).
Fix ownership/permissions on the crowdsec config and data directories (chown -R crowdsec:crowdsec /etc/crowdsec /var/lib/crowdsec).
Re-run cscli hub update && cscli hub upgrade to re-download the missing/corrupt file.
Run the command as the user that owns the hub files or with appropriate privileges.

Example fix

// shell
# before: sha256 fails with permission denied
$ cscli hub update
// after: fix permissions then retry
# chown -R crowdsec:crowdsec /etc/crowdsec /var/lib/crowdsec
# cscli hub update && cscli hub upgrade

Defensive patterns

Strategy: try-catch

Validate before calling

if info, err := os.Stat(path); err != nil || info.IsDir() {
    return fmt.Errorf("item file %s missing or not a regular file", path)
}

Try / catch

if err := setVersionState(...); err != nil {
    if errors.Is(err, fs.ErrPermission) {
        // advise chown/chmod on crowdsec dirs
    }
    if errors.Is(err, fs.ErrNotExist) {
        // re-run cscli hub update/upgrade
    }
    return err
}

Prevention

Run crowdsec/cscli as a user with read access to hub data directories
Avoid external cleanup jobs deleting files under /var/lib/crowdsec
After manual file edits, re-run cscli hub update
Monitor disk for full-disk/partition errors that truncate downloads

When it happens

Trigger: downloader.SHA256(path) fails because the file does not exist, is a directory, or is unreadable (permissions). Occurs during cscli hub install/update/upgrade when item files were removed or partially written.

Common situations: File deleted by an external process after download, permissions changed on /etc/crowdsec or the hub data dir, running as wrong user (permission denied), or path pointing to a directory.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fcf7ad865b0dd989. Report an issue: GitHub.