direnv/direnv · error

unsupported SRI algo

Error message

unsupported SRI algo

What it means

NewWriter maps an sri.Algo to a crypto hash constructor; only SHA256, SHA384, and SHA512 are mapped. Any other Algo value falls into a default branch that panics with this message, since the Writer cannot stream an unsupported hash.

Source

Thrown at pkg/sri/writer.go:29

type Writer struct {
	w    io.Writer
	algo Algo
	h    hash.Hash
}

// NewWriter returns a SRI writer that forwards the write while calculating
// the SRI hash.
func NewWriter(w io.Writer, algo Algo) Writer {
	var h hash.Hash
	switch algo {
	case SHA256:
		h = sha256.New()
	case SHA384:
		h = sha512.New384()
	case SHA512:
		h = sha512.New()
	default:
		panic("unsupported SRI algo")
	}

	return Writer{w, algo, h}
}

func (w Writer) Write(b []byte) (int, error) {
	// First write to the underlying storage
	n, err := w.w.Write(b)
	if err == nil {
		// This should always succeed
		_, _ = w.h.Write(b)
	}
	return n, err
}

// Sum returns the calculated SRI hash
func (w Writer) Sum() *Hash {
	sum := w.h.Sum(nil)

View on GitHub (pinned to b00e451f54)

Solutions

1. Only pass Algo values obtained from sri.Parse or the exported SHA256/SHA384/SHA512 constants
2. Add a case for the new algorithm in NewWriter's switch if you genuinely extended the algo set
3. Validate the algo with an explicit switch or lookup before calling NewWriter instead of relying on the panic

Example fix

// before
w := sri.NewWriter(buf, sri.Algo("md5"))
// after
var algo sri.Algo = sri.SHA256 // only predefined algos
w := sri.NewWriter(buf, algo)

switch algo { case sri.SHA256, sri.SHA384, sri.SHA512: default: return errors.New("unsupported algo") }

func validAlgo(a sri.Algo) bool {
    switch a { case sri.SHA256, sri.SHA384, sri.SHA512: return true }
    return false
}

defer func() { if r := recover(); r != nil { err = fmt.Errorf("sri writer: %v", r) } }()
w := sri.NewWriter(buf, algo)

When it happens

Trigger: Constructing sri.NewWriter with an Algo that bypassed Parse's validation — e.g. a zero-value Hash/Algo, a custom algo string, or refactored code that sets algo manually instead of parsing an SRI string.

Common situations: Programmatically building an Algo from user input without going through Parse; adding a new algo constant without extending NewWriter's switch; uninitialized struct fields defaulting to an invalid algo.

Related errors

• sri: unsupported algo %s
• marshal(): %w
• failed to hash envrc path: %w
• sri: not a hash %v
• panic(err)

AI-assisted analysis of direnv/direnv@b00e451f54 (2026-09-05). Data as JSON: /api/errors/de4378385fbeb14f. Report an issue: GitHub.