different-ai/openwork · error

latest-mac.yml is missing sha512.

Error message

latest-mac.yml is missing sha512.

What it means

The same manifest parser requires a non-empty `sha512` field, which electron includes in latest-mac.yml for download integrity verification. When the hash is missing the artifact is rejected because integrity cannot be validated. Thrown before any download is attempted.

Source

Thrown at apps/app/src/app/lib/electron-alpha.ts:54

  return new URL(pathOrUrl, `${ELECTRON_ALPHA_RELEASE_BASE_URL}/`).toString();
}

export function parseElectronLatestMacYml(
  raw: string,
  arch: "arm64" | "x64",
): ElectronAlphaArtifact {
  const version = parseYamlScalar(raw, "version");
  const path = parseYamlScalar(raw, "path") ?? parseFirstFileUrl(raw);
  const sha512 = parseYamlScalar(raw, "sha512");

  if (!version) {
    throw new Error("latest-mac.yml is missing version.");
  }
  if (!path) {
    throw new Error("latest-mac.yml is missing artifact path/url.");
  }
  if (!sha512) {
    throw new Error("latest-mac.yml is missing sha512.");
  }

  return {
    arch,
    manifestUrl: ELECTRON_ALPHA_LATEST_MAC_YML_URL,
    releaseUrl: ELECTRON_ALPHA_RELEASE_PAGE_URL,
    url: resolveArtifactUrl(path),
    path,
    version,
    sha512,
  };
}

export async function resolveElectronAlphaArtifact(
  arch: "arm64" | "x64" = "arm64",
): Promise<ElectronAlphaArtifact> {
  const response = await desktopFetch(ELECTRON_ALPHA_LATEST_MAC_YML_URL, {
    headers: { Accept: "text/yaml, text/plain, */*" },

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Inspect the raw manifest and verify the `sha512:` key exists and is non-empty.
2. Regenerate the manifest with the standard electron-builder publish flow so the hash is computed and written.
3. If a proxy/mirror strips fields, fetch the manifest from the canonical origin instead.

const text = await (await desktopFetch(ELECTRON_ALPHA_LATEST_MAC_YML_URL, { headers: { Accept: "text/yaml, text/plain, */*" } })).text();
if (!/^sha512:\s*[A-Za-z0-9+/=]+$/m.test(text)) throw new Error("Manifest lacks sha512; integrity check impossible.");

function hasSha512(m: { sha512?: unknown }): m is { sha512: string } {
  return typeof m.sha512 === "string" && m.sha512.length > 0;
}

try {
  const artifact = await resolveElectronAlphaArtifact();
} catch (err) {
  if (err instanceof Error && err.message.includes("missing sha512")) {
    // treat manifest as corrupt; do not install unverified binaries
    console.warn("Manifest missing integrity hash; update aborted.");
  } else throw err;
}

When it happens

Trigger: latest-mac.yml fetched from ELECTRON_ALPHA_LATEST_MAC_YML_URL has `version` and `path` but no `sha512` key — typically a hand-edited manifest, a publish tool that omits the hash, or a truncated response body.

Common situations: Manually regenerated manifests, third-party mirrors stripping the hash, custom publish scripts writing minimal YAML, or electron-builder version differences in hash fields.

Related errors

• latest-mac.yml is missing artifact path/url.
• Failed to fetch latest-mac.yml (${response.status} ${respons
• Failed to copy attachment "${metadata.filename}" into this w
• invalid_json
• ZIP data for ${entry.name} is out of bounds.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/9fe21e23426d20ea. Report an issue: GitHub.