cli/laufey_sums.lock has no pinned laufey version — populate

Error message

cli/laufey_sums.lock has no pinned laufey version — populate it for v{laufey_version} before building

What it means

The Deno CLI build script resolves the laufey crate version from the workspace Cargo.lock and cross-checks cli/laufey_sums.lock — the SHA256SUMS trust anchor for desktop backend downloads — so a stale digest file becomes a compile error instead of a first-launch failure (emit_laufey_version, cli/build.rs:275-299). When laufey_version_from_sums finds no '# version:' directive in the lock file, check_laufey_pinned_sums_version (build.rs:341-350) panics with this message at build time.

Source

Thrown at cli/build.rs:355

      continue;
    };
    let Some(version) = rest.trim().strip_prefix("version:") else {
      continue;
    };
    let pinned = version.trim().trim_start_matches('v');
    if !pinned.is_empty() {
      return Some(pinned.to_string());
    }
  }
  None
}

/// Confirm `cli/laufey_sums.lock` targets `laufey_version`. The lock file carries a
/// `# version: vX.Y.Z` directive that must match the `laufey` crate version
/// the binary is built against; a mismatch means the pinned digests are stale.
fn check_laufey_pinned_sums_version(manifest_dir: &str, laufey_version: &str) {
  let Some(pinned) = laufey_version_from_sums(manifest_dir) else {
    panic!(
      "cli/laufey_sums.lock has no pinned laufey version — populate it for \
       v{laufey_version} before building"
    );
  };
  if pinned != laufey_version {
    panic!(
      "cli/laufey_sums.lock pins Laufey v{pinned} but this build expects \
       v{laufey_version} — refresh the lock file from the upstream SHA256SUMS"
    );
  }
}

/// SHA-256 digests of the vendored AppImage Type-2 runtime stubs (from
/// `cli/tools/appimage_runtime/README.md`). Verified at build time so a
/// silent local modification (or a bad rebase) of those checked-in binaries
/// can't slip into a release build undetected.
const APPIMAGE_RUNTIME_HASHES: &[(&str, &str)] = &[
  (

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Open cli/laufey_sums.lock and add a header line '# version: <X.Y.Z>' where <X.Y.Z> is the laufey version pinned in ../Cargo.lock (grep -A1 'name = "laufey"' Cargo.lock).
Prefer regenerating the whole lock from the upstream SHA256SUMS of that release so the directive and digests agree.
Keep the directive as the first line and configure tooling to preserve comments.

Example fix

# before (cli/laufey_sums.lock — no header)
3f9a1b...  laufey-linux-x86_64.tar.gz

# after
# version: 0.1.4
3f9a1b...  laufey-linux-x86_64.tar.gz

Defensive patterns

Strategy: validation

Validate before calling

# preflight: the lock file must carry a version directive matching Cargo.lock
head -1 cli/laufey_sums.lock | grep -q '^# version: ' \
  || echo 'cli/laufey_sums.lock: missing # version: directive'
grep -A1 'name = "laufey"' Cargo.lock | grep version

Prevention

Keep '# version: X.Y.Z' as the first line of cli/laufey_sums.lock
Teach merge tooling to preserve comment lines in lock files
After creating or rewriting the lock, run a cargo check — the build script fails fast

When it happens

Trigger: Building after creating/renaming cli/laufey_sums.lock without a '# version: X.Y.Z' header line; a lock file truncated during merge-conflict resolution; lock files rewritten by tools or editors that strip comment lines.

Common situations: First build after the laufey integration on a new checkout; merge conflicts resolved by taking one side and losing the header comment; hand-assembled lock files during vendoring work.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/085a90d558fcc73a. Report an issue: GitHub.