dotnet/aspnetcore · error · Exception

Could not find checksum for {path} in Release file.

Error message

Could not find checksum for {path} in Release file.

What it means

parse_release_file scans the Release file for a sha256 (64-hex-char) line whose third column matches the requested relative path (e.g., main/binary-amd64/Packages.gz). If no such entry exists, it raises a plain Exception. This means the Release file does not enumerate the package-index file the script tried to verify — typically because the suite/component/arch combination is wrong or the Release file is for a different distribution layout.

Source

Thrown at eng/common/cross/install-debs.py:154

        print("Signature verified successfully.")

        with open(release_file.name) as f:
            return f.read()

def parse_release_file(content, path):
    """Parses the Release file and returns sha256 checksum of the specified path."""

    # data looks like this:
    # <checksum>  <size>  <path>
    matches = re.findall(r'^ (\S*) +(\S*) +(\S*)$', content, re.MULTILINE)

    for entry in matches:
        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64
        if entry[2] == path and len(entry[0]) == 64:
            return entry[0]

    raise Exception(f"Could not find checksum for {path} in Release file.")

def parse_debian_version(version):
    """Parse a Debian package version into epoch, upstream version, and revision."""
    match = re.match(r'^(?:(\d+):)?([^-]+)(?:-(.+))?$', version)
    if not match:
        raise ValueError(f"Invalid Debian version format: {version}")
    epoch, upstream, revision = match.groups()
    return int(epoch) if epoch else 0, upstream, revision or ""

def compare_upstream_version(v1, v2):
    """Compare upstream or revision parts using Debian rules."""
    def tokenize(version):
        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)
        return [int(x) if x.isdigit() else x for x in tokens if x]

    tokens1 = tokenize(v1)
    tokens2 = tokenize(v2)

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Verify the suite ships the requested component/arch by opening <mirror>/dists/<suite>/ in a browser and checking the directory listing.
2. For Debian ports architectures (loong64, riscv64 etc.), use the ports mirror (deb.debian.org/debian-ports) and the ports keyring, not mainstream debian.
3. Drop --force-check-gpg if you cannot fix the mirror layout — you lose the Release-anchored checksum but the per-deb SHA256 still verifies.
4. Inspect the downloaded Release file to see which paths it actually lists and adjust --suite/--arch accordingly.

Example fix

# before — wrong mirror for a ports arch
python3 install-debs.py --arch loong64 --force-check-gpg \
  --suite sid --mirror http://deb.debian.org/debian ...
# Could not find checksum for main/binary-loong64/Packages.gz

# after — use the ports mirror
python3 install-debs.py --arch loong64 --force-check-gpg \
  --keyring /usr/share/keyrings/debian-ports-archive-keyring.gpg \
  --suite sid --mirror http://deb.debian.org/debian-ports ...

# Confirm the path is listed in the Release file before fetch_and_decompress
path = f'{component}/binary-{arch}/Packages.gz'
async with session.get(release_url) as r:
    release_text = await r.text()
if path not in release_text:
    print(f'{path} absent from Release for suite {suite}; wrong mirror/arch/component')
    # skip verification for this path or abort

try:
    packages_sha = parse_release_file(release_file_content, path)
except Exception as e:
    if 'Could not find checksum' in str(e):
        # mirror layout does not cover this path; either fix the mirror or skip sig check
        print(f'{path} not in Release; consider --suite/--mirror change or drop --force-check-gpg')
        return None
    raise

When it happens

Trigger: Called from fetch_and_decompress when check_sig is True. Triggered when the constructed path (e.g., universe/binary-loong64/Packages.gz) is not listed in the Release file's sha256 checksum section. Common with non-main components, uncommon architectures, or suites that do not ship universe.

Common situations: Asking for a component (universe) the suite does not have; an arch the Release file does not enumerate (e.g., loong64 on a mainstream Debian mirror instead of the ports mirror); Release file from a minimal mirror that omits some indices.

Related errors

• SHA256 mismatch for {path}: expected {packages_sha}, got {sh
• SHA256 mismatch for {url}: expected {checksum}, got {sha256}
• Signature verification failed: {result.stderr.decode('utf-8'
• Failed to download {url}, Status Code: {response.status}
• Failed to download {url} after {max_retries} attempts.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/909ff41c913822a3. Report an issue: GitHub.