goreleaser/goreleaser · error

invalid algorithm: %s

Error message

invalid algorithm: %s

What it means

Artifact.Checksum validates the algorithm argument against a fixed switch (blake2b, blake2s, blake3, crc32, md5, sha1, sha256, sha512, sha3-224/256/384/512, etc.). Any unrecognized string falls into the default branch and returns 'invalid algorithm: %s'. This is a pure argument-validation error — no file I/O has happened beyond the open.

Source

Thrown at internal/artifact/artifact.go:409

		h = sha256.New224()
	case "sha384":
		h = sha512.New384()
	case "sha256":
		h = sha256.New()
	case "sha1":
		h = sha1.New()
	case "sha512":
		h = sha512.New()
	case "sha3-224":
		h = hash.Hash(sha3.New224())
	case "sha3-384":
		h = hash.Hash(sha3.New384())
	case "sha3-256":
		h = hash.Hash(sha3.New256())
	case "sha3-512":
		h = hash.Hash(sha3.New512())
	default:
		return "", fmt.Errorf("invalid algorithm: %s", algorithm)
	}

	if _, err := io.Copy(h, file); err != nil {
		return "", fmt.Errorf("failed to checksum: %w", err)
	}
	check := hex.EncodeToString(h.Sum(nil))
	if a.Extra == nil {
		a.Extra = make(Extras)
	}
	a.Extra[ExtraChecksum] = fmt.Sprintf("%s:%s", algorithm, check)
	return check, nil
}

var noRefresh = func() error { return nil }

// Refresh executes a Refresh extra function on artifacts, if it exists.
func (a Artifact) Refresh() error {
	// for now lets only do it for checksums, as we know for a fact that

View on GitHub (pinned to f5edd73956)

Solutions

1. Use one of the exact supported names, lowercase: sha256, sha512, sha1, md5, crc32, blake2s, blake2b, blake3, sha3-256, etc.
2. Replace hyphens/uppercase: 'SHA-256' -> 'sha256'.
3. Check the switch in internal/artifact/artifact.go for the definitive list of accepted algorithms.
4. If you need an unsupported algorithm, compute it yourself from the artifact file instead of via Checksum.

Example fix

// before
sum, err := art.Checksum("SHA-256") // invalid algorithm: SHA-256
// after
sum, err := art.Checksum("sha256")

var validAlgos = map[string]bool{
    "crc32": true, "md5": true, "sha1": true, "sha256": true, "sha512": true,
    "sha3-224": true, "sha3-256": true, "sha3-384": true, "sha3-512": true,
    "blake2s": true, "blake2b": true, "blake3": true,
}
func checkAlgo(algo string) error {
    if !validAlgos[algo] {
        return fmt.Errorf("unsupported algorithm %q", algo)
    }
    return nil
}

sum, err := art.Checksum(algo)
if err != nil {
    if strings.HasPrefix(err.Error(), "invalid algorithm") {
        return fmt.Errorf("use a lowercase supported name like sha256, got %q", algo)
    }
    return err
}

When it happens

Trigger: Calling Checksum with a misspelled or unsupported algorithm name, e.g. 'SHA256' (uppercase, case-sensitive), 'sha-256' (hyphenated), 'sha224', or 'xxhash'; used by checksum publishers, uploadAsset, and refreshOne flows.

Common situations: Configuring a checksum/publisher stage with 'SHA-256' or 'sha-256' instead of 'sha256', assuming SHA-224 is supported, or passing user input straight through as the algorithm.

Related errors

• failed to checksum: %w
• failed to write jsonschema file: %w
• failed to apply template %s: %w
• globbing failed for pattern %s: %w
• failed to parse %s: %w

AI-assisted analysis of goreleaser/goreleaser@f5edd73956 (2026-09-05). Data as JSON: /api/errors/f154de69ddf5e8af. Report an issue: GitHub.