github/copilot-sdk · error

SHA256SUMS.txt does not contain

Error message

SHA256SUMS.txt does not contain %s

What it means

After successfully parsing SHA256SUMS.txt, getReleaseChecksum looks up the expected asset name and errors if it is absent. This is a safeguard so the bundler never downloads a package it cannot checksum-verify.

Solutions

1. Compare assetName against the actual entries in SHA256SUMS.txt (curl + grep)
2. Fix the assetName construction (releaseDownloadURL/asset naming) to match upstream naming
3. Use a version whose SHA256SUMS.txt includes your target platform, or skip unsupported platforms in the build matrix
4. If you control the release, re-upload complete SHA256SUMS.txt

Example fix

// before
checksum, ok := checksums[assetName]
if !ok {
	return "", fmt.Errorf("SHA256SUMS.txt does not contain %s", assetName)
}
// after
checksum, ok := checksums[assetName]
if !ok {
	return "", fmt.Errorf("SHA256SUMS.txt does not contain %s (available: %v)", assetName, keys(checksums))
}

sums, err := fetchChecksums(baseURL, version)
if err != nil { return err }
if _, ok := sums[assetName]; !ok {
	return fmt.Errorf("asset %s not listed in checksums for v%s; check platform/arch support", assetName, version)
}

func checksumAvailable(checksums map[string]string, assetName string) bool {
	_, ok := checksums[assetName]
	return ok
}

checksum, err := getReleaseChecksum(baseURL, version, assetName)
if err != nil {
	if strings.Contains(err.Error(), "does not contain") {
		// wrong version or unsupported platform; fix assetName/version
	}
	return err
}

When it happens

Trigger: checksums map has no entry for assetName — the platform/arch asset filename built by the bundler is not listed in that release's SHA256SUMS.txt.

Common situations: Version bump where the release renamed assets (GOOS/GOARCH naming change); requesting an asset for an unsupported OS/arch; partial upload of the release missing the checksum entry; assetName constructed with wrong extension or suffix.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• failed to get SDK version
• checksum mismatch for
• must be a SHA-256 hash ( bytes), got bytes
• %sRuntimeExecutableHash must be a SHA-256 hash
• %sRuntimeNodeHash must be a SHA-256 hash

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/9792394b6065081f. Report an issue: GitHub.

Appendix: source

Thrown at go/cmd/bundler/main.go:984

		fmt.Printf("Downloading checksums from %s...\n", checksumsURL)
		resp, err := releaseHTTPClient.Get(checksumsURL)
		if err != nil {
			return "", fmt.Errorf("failed to download checksums: %w", err)
		}
		defer resp.Body.Close()
		if resp.StatusCode != http.StatusOK {
			return "", fmt.Errorf("failed to download checksums: %s", resp.Status)
		}
		contents, err := io.ReadAll(resp.Body)
		if err != nil {
			return "", fmt.Errorf("failed to read checksums: %w", err)
		}
		checksums = parseReleaseChecksums(string(contents))
		releaseChecksumCache[cacheKey] = checksums
	}
	checksum, ok := checksums[assetName]
	if !ok {
		return "", fmt.Errorf("SHA256SUMS.txt does not contain %s", assetName)
	}
	return checksum, nil
}

// downloadCLIBinary downloads the verified release package and extracts the CLI binary. It
// returns the extracted binary path and the downloaded tarball path (retained so
// callers can extract additional files, such as the runtime library).
func downloadCLIBinary(runtimePlatform, binaryName, cliVersion, destDir string) (string, string, error) {
	assetName := releaseAssetName(cliVersion, runtimePlatform)
	expectedChecksum, err := getReleaseChecksum(cliVersion, assetName)
	if err != nil {
		return "", "", err
	}
	tarballURL := releaseDownloadURL(cliVersion, assetName)

	fmt.Printf("Downloading from %s...\n", tarballURL)

	resp, err := releaseHTTPClient.Get(tarballURL)

View on GitHub (pinned to cd8cf15dc3)