{"id":"e6f19e335545436a","repo":"evanw/esbuild","slug":"missing-hash-for-key","errorCode":null,"errorMessage":"Missing hash for \"${key}\"","messagePattern":"Missing hash for \"(.+?)\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"lib/npm/node-install.ts","lineNumber":232,"sourceCode":"      // executable instead of a JavaScript file.\n      isToPathJS = false\n\n      // If this install script is being re-run, then \"renameSync\" will fail\n      // since the underlying inode is the same (it just returns without doing\n      // anything, and without throwing an error). In that case we should remove\n      // the file manually.\n      fs.unlinkSync(tempPath)\n    } catch {\n      // Ignore errors here since this optimization is optional\n    }\n  }\n}\n\nfunction binaryIntegrityCheck(pkg: string, subpath: string, bytes: Uint8Array): void {\n  const hash = crypto.createHash('sha256').update(bytes).digest('hex')\n  const key = `${pkg}/${subpath}`\n  const expected = packageJSON['esbuild.binaryHashes'][key]\n  if (!expected) throw new Error(`Missing hash for \"${key}\"`)\n  if (hash !== expected) throw new Error(`\"${hash.slice(0, 8)}...\" doesn't match \"${expected.slice(0, 8)}...\" for \"${pkg}\"`)\n}\n\nasync function downloadDirectlyFromNPM(pkg: string, subpath: string, binPath: string): Promise<void> {\n  // If that fails, the user could have npm configured incorrectly or could not\n  // have npm installed. Try downloading directly from npm as a last resort.\n  const url = `https://registry.npmjs.org/${pkg}/-/${pkg.replace('@esbuild/', '')}-${packageJSON.version}.tgz`\n  console.error(`[esbuild] Trying to download ${JSON.stringify(url)}`)\n  try {\n    const bytes = extractFileFromTarGzip(await fetch(url), subpath)\n    binaryIntegrityCheck(pkg, subpath, bytes)\n    fs.writeFileSync(binPath, bytes)\n    fs.chmodSync(binPath, 0o755)\n  } catch (e: any) {\n    console.error(`[esbuild] Failed to download ${JSON.stringify(url)}: ${e && e.message || e}`)\n    throw e\n  }\n}","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/evanw/esbuild/blob/6ff1d8b0d8c134e867a397eef39702a223ebef9e/lib/npm/node-install.ts#L214-L250","documentation":"`binaryIntegrityCheck` (`node-install.ts:232`) sha256-hashes the downloaded binary and looks up the expected hash under `${pkg}/${subpath}` in `packageJSON['esbuild.binaryHashes']`. If that key isn't present, the JS package itself doesn't know what hash to expect — meaning the published JS package was assembled without registering that binary subpath.","triggerScenarios":"The install fallback path runs `binaryIntegrityCheck` for a `(pkg, subpath)` pair whose key is absent from the `esbuild.binaryHashes` map inside `npm/esbuild/package.json`. The integrity check refuses to proceed without a known-good hash.","commonSituations":"A new platform package (e.g. `@esbuild/linux-loong64`) was added to `knownUnixlikePackages` but the release didn't update `esbuild.binaryHashes`; user is on an unreleased/RC build; the package.json was patched by a fork that added a platform key without the hash; corrupted or partially-overwritten package.json.","solutions":["Upgrade to a released esbuild version where the binaryHashes map is complete for your platform.","Downgrade to a version known to support your platform.","If you're a fork maintainer, ensure `esbuild.binaryHashes` includes every `(pkg, subpath)` you reference in `knownUnixlikePackages`/`knownWindowsPackages`/`knownWebAssemblyFallbackPackages`.","Report the missing hash upstream with the exact esbuild version and platform key."],"exampleFix":"// npm/esbuild/package.json (fork fix)\n// before\n\"esbuild.binaryHashes\": { \"@esbuild/linux-x64/bin/esbuild\": \"abc...\" }\n\n// after\n\"esbuild.binaryHashes\": {\n  \"@esbuild/linux-x64/bin/esbuild\": \"abc...\",\n  \"@esbuild/linux-loong64/bin/esbuild\": \"def...\"\n}","handlingStrategy":"validation","validationCode":"import hashes from 'esbuild/package.json'\nfunction platformHashKnown(pkg: string, subpath: string): boolean {\n  return !!hashes['esbuild.binaryHashes']?.[`${pkg}/${subpath}`]\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin to released esbuild versions that ship hashes for your platform.","If you fork esbuild, update esbuild.binaryHashes for every platform you reference.","Audit knownUnixlikePackages additions for matching hash entries.","Report missing hashes upstream with version + platform details."],"tags":["install","integrity-check","sha256","platform-support","packaging"],"analyzedSha":"6ff1d8b0d8c134e867a397eef39702a223ebef9e","analyzedAt":"2026-08-03T19:42:38.433Z","schemaVersion":2}