different-ai/openwork · error

latest-mac.yml is missing sha512.

Error message

latest-mac.yml is missing sha512.

What it means

The same manifest parser requires a non-empty `sha512` field, which electron includes in latest-mac.yml for download integrity verification. When the hash is missing the artifact is rejected because integrity cannot be validated. Thrown before any download is attempted.

Solutions

1. Inspect the raw manifest and verify the `sha512:` key exists and is non-empty.
2. Regenerate the manifest with the standard electron-builder publish flow so the hash is computed and written.
3. If a proxy/mirror strips fields, fetch the manifest from the canonical origin instead.

const text = await (await desktopFetch(ELECTRON_ALPHA_LATEST_MAC_YML_URL, { headers: { Accept: "text/yaml, text/plain, */*" } })).text();
if (!/^sha512:\s*[A-Za-z0-9+/=]+$/m.test(text)) throw new Error("Manifest lacks sha512; integrity check impossible.");

function hasSha512(m: { sha512?: unknown }): m is { sha512: string } {
  return typeof m.sha512 === "string" && m.sha512.length > 0;
}

try {
  const artifact = await resolveElectronAlphaArtifact();
} catch (err) {
  if (err instanceof Error && err.message.includes("missing sha512")) {
    // treat manifest as corrupt; do not install unverified binaries
    console.warn("Manifest missing integrity hash; update aborted.");
  } else throw err;
}

When it happens

Trigger: latest-mac.yml fetched from ELECTRON_ALPHA_LATEST_MAC_YML_URL has `version` and `path` but no `sha512` key — typically a hand-edited manifest, a publish tool that omits the hash, or a truncated response body.

Common situations: Manually regenerated manifests, third-party mirrors stripping the hash, custom publish scripts writing minimal YAML, or electron-builder version differences in hash fields.

Related errors

• latest-mac.yml is missing artifact path/url.
• cached_app_digest_mismatch
• Could not capture screenshot after action.
• Failed to copy attachment
• Failed to fetch latest-mac.yml

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/9fe21e23426d20ea. Report an issue: GitHub.

Appendix: source

Thrown at apps/app/src/app/lib/electron-alpha.ts:54

  return new URL(pathOrUrl, `${ELECTRON_ALPHA_RELEASE_BASE_URL}/`).toString();
}

export function parseElectronLatestMacYml(
  raw: string,
  arch: "arm64" | "x64",
): ElectronAlphaArtifact {
  const version = parseYamlScalar(raw, "version");
  const path = parseYamlScalar(raw, "path") ?? parseFirstFileUrl(raw);
  const sha512 = parseYamlScalar(raw, "sha512");

  if (!version) {
    throw new Error("latest-mac.yml is missing version.");
  }
  if (!path) {
    throw new Error("latest-mac.yml is missing artifact path/url.");
  }
  if (!sha512) {
    throw new Error("latest-mac.yml is missing sha512.");
  }

  return {
    arch,
    manifestUrl: ELECTRON_ALPHA_LATEST_MAC_YML_URL,
    releaseUrl: ELECTRON_ALPHA_RELEASE_PAGE_URL,
    url: resolveArtifactUrl(path),
    path,
    version,
    sha512,
  };
}

export async function resolveElectronAlphaArtifact(
  arch: "arm64" | "x64" = "arm64",
): Promise<ElectronAlphaArtifact> {
  const response = await desktopFetch(ELECTRON_ALPHA_LATEST_MAC_YML_URL, {
    headers: { Accept: "text/yaml, text/plain, */*" },

View on GitHub (pinned to 2b7df46e8a)