What causes "no SHA-256 hash for %s in %s" in golang/go?

Confirm the snapshot version in GOFIPS140 matches a Go toolchain whose fips140.sum lists it.

no SHA-256 hash for %s in %s

Error message

no SHA-256 hash for %s in %s

What it means

Returned by verifyZipSum (FIPS 140 snapshot verification) when the fips140.sum file at GOROOT/lib/fips140/fips140.sum has no 'NAME HASH' entry whose NAME matches the basename of the FIPS zip being verified. The snapshot system cannot prove integrity without an expected hash.

Source

Thrown at src/cmd/go/internal/fips140/fips140.go:274

	}
	name := filepath.Base(zipfile)
	var want string
	for line := range strings.SplitSeq(string(sums), "\n") {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		n, h, ok := strings.Cut(line, " ")
		if !ok {
			continue
		}
		if n == name {
			want = strings.TrimSpace(h)
			break
		}
	}
	if want == "" {
		return fmt.Errorf("no SHA-256 hash for %s in %s", name, sumfile)
	}
	f, err := os.Open(zipfile)
	if err != nil {
		return err
	}
	defer f.Close()
	h := sha256.New()
	if _, err := io.Copy(h, f); err != nil {
		return err
	}
	if got := fmt.Sprintf("%x", h.Sum(nil)); got != want {
		return fmt.Errorf("SHA-256 hash of %s is %s, want %s (from %s)", name, got, want, sumfile)
	}
	return nil
}

// ResolveImport resolves the import path imp.
// If it is of the form crypto/internal/fips140/foo

View on GitHub (pinned to b6b368adc5)

Solutions

Confirm the snapshot version in GOFIPS140 matches a Go toolchain whose fips140.sum lists it.
Reinstall/upgrade the Go toolchain so GOROOT/lib/fips140/fips140.sum is consistent with the bundled snapshots.
Inspect fips140.sum and verify the expected zip basename appears on a non-comment line.
Avoid mixing snapshot zips from a different toolchain version into this GOROOT's cache.

Example fix

# before — snapshot zip not registered in the toolchain's sum file
$ GOFIPS140=v1.2.3 go build ./...
error: no SHA-256 hash for fips140-v1.2.3.zip in .../fips140.sum
# after — use a toolchain that ships that snapshot
$ go1.99 toolchain ... && GOFIPS140=v1.2.3 go build ./...

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the requested snapshot version is listed in the toolchain's sum file
// before running the build.
func snapshotRegistered(sumfile, name string) bool {
    b, err := os.ReadFile(sumfile)
    if err != nil { return false }
    for line := range strings.SplitSeq(string(b), "\n") {
        line = strings.TrimSpace(line)
        if line == "" || strings.HasPrefix(line, "#") { continue }
        if n, _, ok := strings.Cut(line, " "); ok && n == name { return true }
    }
    return false
}

Prevention

Pin GOFIPS140 to a version bundled with the active toolchain.
Keep the toolchain and its bundled fips140.sum in sync — never mix versions.
Never manually add snapshot zips without updating the sum file.

When it happens

Trigger: GOFIPS140 set to a snapshot version whose zip is present in the module cache but is not listed (or is listed under a different name) in GOROOT/lib/fips140/fips140.sum.

Common situations: Mixed Go toolchains where the toolchain's bundled fips140.sum does not know about the snapshot requested; manually added snapshot zips without updating the sum file; mismatched snapshot naming (e.g. case, suffix).

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/0a85f3b7d44d8d16. Report an issue: GitHub.