dotnet/yarp · error · Exception

Could not find checksum for {path} in Release file.

Error message

Could not find checksum for {path} in Release file.

What it means

This exception is raised in parse_release_file when the Release file does not contain a SHA-256 checksum entry for the requested path. The function uses regex to find lines matching ' <checksum> <size> <path>' in the Release file, filters for entries whose checksum is 64 hex characters (sha256, as opposed to md5 which is 32), and returns the first match where entry[2] equals the requested path. If none is found, the path simply does not exist in that suite/component/architecture combination, or the Release file is from a different repository structure.

Source

Thrown at eng/common/cross/install-debs.py:154

        print("Signature verified successfully.")

        with open(release_file.name) as f:
            return f.read()

def parse_release_file(content, path):
    """Parses the Release file and returns sha256 checksum of the specified path."""

    # data looks like this:
    # <checksum>  <size>  <path>
    matches = re.findall(r'^ (\S*) +(\S*) +(\S*)$', content, re.MULTILINE)

    for entry in matches:
        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64
        if entry[2] == path and len(entry[0]) == 64:
            return entry[0]

    raise Exception(f"Could not find checksum for {path} in Release file.")

def parse_debian_version(version):
    """Parse a Debian package version into epoch, upstream version, and revision."""
    match = re.match(r'^(?:(\d+):)?([^-]+)(?:-(.+))?$', version)
    if not match:
        raise ValueError(f"Invalid Debian version format: {version}")
    epoch, upstream, revision = match.groups()
    return int(epoch) if epoch else 0, upstream, revision or ""

def compare_upstream_version(v1, v2):
    """Compare upstream or revision parts using Debian rules."""
    def tokenize(version):
        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)
        return [int(x) if x.isdigit() else x for x in tokens if x]

    tokens1 = tokenize(v1)
    tokens2 = tokenize(v2)

View on GitHub (pinned to bd11867bee)

Solutions

1. Print the Release file content and the requested path to verify the path actually exists in the file.
2. Confirm the --suite, component (main/universe), and --arch combination is valid for the chosen mirror -- check the mirror's dists/<suite>/ directory listing.
3. Try the 'main' component only (drop 'universe' if the mirror doesn't have it).
4. Verify the Release file was downloaded correctly (not an HTML error page) by printing its first few lines.
5. If the Release file uses a different path format (e.g. leading './' or absolute paths), adjust the path comparison or normalise both sides.
6. Check whether the mirror uses InRelease (combined file) instead of separate Release/Release.gpg.

# Pre-check: verify the path exists in the Release file before downloading Packages.gz.
release_content = await fetch_release_file(session, mirror, suite, keyring)
matches = re.findall(r'^(\S*) +(\S*) +(\S*)$', release_content, re.MULTILINE)
found = any(entry[2] == path and len(entry[0]) == 64 for entry in matches)
if not found:
    print(f"Path '{path}' not found in Release file for suite '{suite}'.")

# Check if the path exists in the Release file before calling parse_release_file
def has_checksum(content, path):
    matches = re.findall(r'^(\S*) +(\S*) +(\S*)$', content, re.MULTILINE)
    return any(entry[2] == path and len(entry[0]) == 64 for entry in matches)

# Wrap the call and handle missing checksums gracefully
try:
    packages_sha = parse_release_file(release_file_content, path)
except Exception as e:
    if 'Could not find checksum' in str(e):
        print(f"Component/arch not available for suite '{suite}'. Skipping.")
        return None
    raise

When it happens

Trigger: parse_release_file (lines 142-154) is called from fetch_and_decompress (line 101) with path = f'{component}/binary-{arch}/Packages.gz'. The function scans the Release file content for a matching sha256 line. The exception fires when the path is not listed -- meaning that suite does not have that component for that architecture, or the Release file covers a different set of packages. For example, requesting 'universe/binary-loong64/Packages.gz' when the suite only has 'main' for that arch.

Common situations: Requesting the 'universe' component on a Debian mirror that only has 'main'; requesting an architecture (e.g. loong64, riscv64) that the suite does not support for that component; the suite name is misspelled or does not exist on this mirror; the Release file format differs from expected (e.g. InRelease instead of separate Release); the regex pattern does not match the mirror's Release file formatting (different whitespace conventions).

Related errors

• SHA256 mismatch for {path}: expected {packages_sha}, got {sh
• SHA256 mismatch for {url}: expected {checksum}, got {sha256}
• Failed to download {url}, Status Code: {response.status}
• Invalid Debian version format: {version}
• Failed to download {url} after {max_retries} attempts.

AI-assisted analysis of dotnet/yarp@bd11867bee (2026-08-13). Data as JSON: /api/errors/8092bb739b52b631. Report an issue: GitHub.