dotnet/runtime · error · Exception

Could not find checksum for {path} in Release file.

Error message

Could not find checksum for {path} in Release file.

What it means

parse_release_file walks the SHA-256 checksum block of the Release file looking for an entry whose path matches the requested file (e.g. main/binary-arm64/Packages.gz) and whose checksum field is 64 hex chars. If none is found, the script cannot verify that file's integrity and throws rather than trusting an unverified download.

Source

Thrown at eng/common/cross/install-debs.py:154

        print("Signature verified successfully.")

        with open(release_file.name) as f:
            return f.read()

def parse_release_file(content, path):
    """Parses the Release file and returns sha256 checksum of the specified path."""

    # data looks like this:
    # <checksum>  <size>  <path>
    matches = re.findall(r'^ (\S*) +(\S*) +(\S*)$', content, re.MULTILINE)

    for entry in matches:
        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64
        if entry[2] == path and len(entry[0]) == 64:
            return entry[0]

    raise Exception(f"Could not find checksum for {path} in Release file.")

def parse_debian_version(version):
    """Parse a Debian package version into epoch, upstream version, and revision."""
    match = re.match(r'^(?:(\d+):)?([^-]+)(?:-(.+))?$', version)
    if not match:
        raise ValueError(f"Invalid Debian version format: {version}")
    epoch, upstream, revision = match.groups()
    return int(epoch) if epoch else 0, upstream, revision or ""

def compare_upstream_version(v1, v2):
    """Compare upstream or revision parts using Debian rules."""
    def tokenize(version):
        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)
        return [int(x) if x.isdigit() else x for x in tokens if x]

    tokens1 = tokenize(v1)
    tokens2 = tokenize(v2)

View on GitHub (pinned to 60108ba66e)

Solutions

1. Confirm the component exists for the suite/arch by inspecting the Release file (look for the main/binary-<arch>/Packages.gz SHA256 line).
2. Match --arch to a real arch on the mirror (amd64, arm64, armhf, i386 on Debian; ports mirror for loong64/riscv64).
3. If using a suite without that component, switch --suite to one that has it.
4. Inspect the downloaded Release file to confirm it is well-formed (not an HTML error page from a misconfigured mirror).

Example fix

# before
python3 install-debs.py --force-check-gpg --suite bookworm --arch loong64 --mirror http://deb.debian.org/debian ...
# Could not find checksum for main/binary-loong64/Packages.gz

# after
python3 install-debs.py --force-check-gpg --suite sid --arch loong64 --mirror http://ftp.ports.debian.org/debian-ports ...

# Pre-flight: confirm the Release file lists the requested path before building.
import re
def release_lists_path(release_text: str, path: str) -> bool:
    matches = re.findall(r'^ (\S{64}) +\S+ +(\S+)$', release_text, re.MULTILINE)
    return any(p == path for _, p in matches)

# Fetch <mirror>/dists/<suite>/Release, check for main/binary-<arch>/Packages.gz.

try:
    main()
except Exception as e:
    if 'Could not find checksum' in str(e):
        print('Requested component/suite/arch not present in Release; fix --arch/--suite/--mirror.')
        sys.exit(2)
    raise

When it happens

Trigger: With --force-check-gpg, fetch_and_decompress asks parse_release_file for the checksum of a Packages.gz path that is not listed in the Release file. Raised at install-debs.py:154. Happens when the component/suite/arch combination does not exist (e.g. requesting 'universe' on a Debian mirror, or a non-existent arch).

Common situations: Wrong --suite (e.g. a release that does not ship the requested component). Wrong --arch (requesting loong64 on a mirror that does not carry it). Component mismatch (requesting 'universe' on plain Debian, or 'main' only on Ubuntu when the package is in 'universe'). Mirror that strips checksum entries.

Related errors

• SHA256 mismatch for {path}: expected {packages_sha}, got {sh
• SHA256 mismatch for {url}: expected {checksum}, got {sha256}
• Signature verification failed: {result.stderr.decode('utf-8'
• Failed to download {url}, Status Code: {response.status}
• Failed to download {url} after {max_retries} attempts.

AI-assisted analysis of dotnet/runtime@60108ba66e (2026-08-10). Data as JSON: /api/errors/0527ddfb2b8d11b4. Report an issue: GitHub.