denoland/deno · critical

checked-in AppImage runtime stub {} does not match the SHA-2

Error message

checked-in AppImage runtime stub {} does not match the SHA-256 pinned in cli/tools/appimage_runtime/README.md (expected {expected}, got {actual}). If this update is intentional, refresh both the binary and the README.

What it means

cli/build.rs pins SHA-256 digests for the vendored AppImage Type-2 runtime stubs (APPIMAGE_RUNTIME_HASHES, mirrored in cli/tools/appimage_runtime/README.md). check_appimage_runtime_hashes (build.rs:385-403) hashes each checked-in binary at build time and panics on a mismatch — a guard so a silent local modification or bad rebase cannot slip into a release build. A missing file is tolerated (the read error is skipped with continue); only a present-but-different binary triggers the panic.

Source

Thrown at cli/build.rs:395

  (
    "tools/appimage_runtime/runtime-aarch64",
    "00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444",
  ),
];

fn check_appimage_runtime_hashes() {
  use sha2::Digest;
  let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
  for (rel, expected) in APPIMAGE_RUNTIME_HASHES {
    let path = Path::new(&manifest_dir).join(rel);
    println!("cargo:rerun-if-changed={}", path.display());
    let bytes = match std::fs::read(&path) {
      Ok(b) => b,
      Err(_) => continue,
    };
    let actual = format!("{:x}", sha2::Sha256::digest(&bytes));
    if actual != *expected {
      panic!(
        "checked-in AppImage runtime stub {} does not match the SHA-256 \
         pinned in cli/tools/appimage_runtime/README.md (expected {expected}, got {actual}). \
         If this update is intentional, refresh both the binary and the README.",
        path.display()
      );
    }
  }
}

fn compress_appimage_runtimes(out_dir: &Path) {
  let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
  let output_dir = out_dir.join("appimage_runtime");
  std::fs::create_dir_all(&output_dir).unwrap();

  for (rel, _) in APPIMAGE_RUNTIME_HASHES {
    let path = Path::new(&manifest_dir).join(rel);
    let contents = std::fs::read(&path).unwrap();
    let compressed = zstd::bulk::compress(&contents, 19).unwrap();

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. If unintentional: restore the originals — git checkout -- cli/tools/appimage_runtime/ — then rebuild.
2. Verify manually: sha256sum cli/tools/appimage_runtime/<file> against the table in cli/tools/appimage_runtime/README.md.
3. If the update is intentional: replace the stub and refresh both APPIMAGE_RUNTIME_HASHES in cli/build.rs and the README table in the same commit, as the panic message instructs.

Example fix

# before
cargo build --release
# panic: checked-in AppImage runtime stub ... does not match the SHA-256 ...

# after
git checkout -- cli/tools/appimage_runtime/
sha256sum cli/tools/appimage_runtime/*  # compare with README table
cargo build --release

# preflight: verify pinned runtime stubs before a release build
cd cli/tools/appimage_runtime
sha256sum * # compare each line against the table in README.md

When it happens

Trigger: Rebuilding after locally patching or rewriting a runtime stub; git filters, autocrlf, or permission rewrites touching the binary; rebases that restore an older stub version; corrupted files from a flaky fetch.

Common situations: Intentional runtime bumps that updated the binary but not the README/build.rs pins; contributors on Windows line-ending configs corrupting binaries; partial checkouts after conflict resolution.

Related errors

• expected file "{file}" to exist
• cli/laufey_sums.lock has no pinned laufey version — populate
• cli/laufey_sums.lock pins Laufey v{pinned} but this build ex
• {ENABLE_ENV} must be unset or set to 1
• startup ordering is only supported by the release profile

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/c3133771a7b93f6c. Report an issue: GitHub.