github/copilot-sdk · error

failed to download checksums

Error message

failed to download checksums: %w

What it means

getReleaseChecksum fetches SHA256SUMS.txt for a release version and wraps network-level failures of that HTTP GET in this error. downloadCLIBinary needs the checksum to verify the package before extraction, so a failed download aborts it.

Solutions

1. Check network connectivity and proxy settings (HTTP_PROXY/HTTPS_PROXY) on the build machine
2. Verify baseURL and cliVersion are correct and the host is reachable (curl the checksumsURL)
3. Increase releaseHTTPClient timeout or configure a proxy-aware client
4. Retry the build if it was a transient network error

Example fix

// before
resp, err := releaseHTTPClient.Get(checksumsURL)
if err != nil {
	return "", fmt.Errorf("failed to download checksums: %w", err)
}
// after
if err := pingHost(baseURL); err != nil {
	return "", fmt.Errorf("checksum host unreachable (check network/proxy): %w", err)
}
resp, err := releaseHTTPClient.Get(checksumsURL)
if err != nil {
	return "", fmt.Errorf("failed to download checksums: %w", err)
}

u, err := url.Parse(fmt.Sprintf("%s/v%s/SHA256SUMS.txt", baseURL, version))
if err != nil || u.Scheme != "https" && u.Scheme != "http" {
	return fmt.Errorf("invalid checksums URL: %s", u)
}

resp, err := releaseHTTPClient.Get(checksumsURL)
if err != nil {
	var netErr net.Error
	if errors.As(err, &netErr) && netErr.Timeout() {
		// retry with backoff
	}
	return "", fmt.Errorf("failed to download checksums: %w", err)
}

When it happens

Trigger: releaseHTTPClient.Get(checksumsURL) returns a transport error when downloading <baseURL>/v<version>/SHA256SUMS.txt: DNS failure, connection refused/reset, TLS error, timeout, or offline machine.

Common situations: No internet access or corporate proxy blocking the host; wrong baseURL or version producing an unreachable URL; firewall/VPN issues; releaseHTTPClient timeout too short on slow networks.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• failed to download
• Failed to download from
• failed to download CLI binary
• failed to read checksums
• failed to save tarball

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/e407770b7d5e9135. Report an issue: GitHub.

Appendix: source

Thrown at go/cmd/bundler/main.go:969

		fields := strings.Fields(line)
		if len(fields) != 2 || !hashPattern.MatchString(fields[0]) {
			continue
		}
		checksums[strings.TrimPrefix(fields[1], "*")] = strings.ToLower(fields[0])
	}
	return checksums
}

func getReleaseChecksum(version, assetName string) (string, error) {
	baseURL := cliDownloadBaseURL()
	cacheKey := baseURL + "\x00" + version
	checksums, ok := releaseChecksumCache[cacheKey]
	if !ok {
		checksumsURL := fmt.Sprintf("%s/v%s/SHA256SUMS.txt", baseURL, version)
		fmt.Printf("Downloading checksums from %s...\n", checksumsURL)
		resp, err := releaseHTTPClient.Get(checksumsURL)
		if err != nil {
			return "", fmt.Errorf("failed to download checksums: %w", err)
		}
		defer resp.Body.Close()
		if resp.StatusCode != http.StatusOK {
			return "", fmt.Errorf("failed to download checksums: %s", resp.Status)
		}
		contents, err := io.ReadAll(resp.Body)
		if err != nil {
			return "", fmt.Errorf("failed to read checksums: %w", err)
		}
		checksums = parseReleaseChecksums(string(contents))
		releaseChecksumCache[cacheKey] = checksums
	}
	checksum, ok := checksums[assetName]
	if !ok {
		return "", fmt.Errorf("SHA256SUMS.txt does not contain %s", assetName)
	}
	return checksum, nil
}

View on GitHub (pinned to cd8cf15dc3)