hashicorp/nomad · error

checksum must be given as "type:value"; got %q

Error message

checksum must be given as "type:value"; got %q

What it means

Inline artifact checksums must be formatted as "type:value", e.g. "sha256:abcd...". The validator splits on the first colon only (so URL values with colons are fine) and errors if no colon is present, meaning the type and value cannot be distinguished.

Source

Thrown at nomad/structs/structs.go:9969

	}

	// Job struct validation occurs before interpolation resolution can be effective.
	// Skip checking if checksum contain variable reference, and artifacts fetching will
	// eventually fail, if checksum is indeed invalid.
	if args.ContainsEnv(check) {
		return nil
	}

	check = strings.TrimSpace(check)
	if check == "" {
		return fmt.Errorf("checksum value cannot be empty")
	}

	// Cut on the first colon only: a "file:<url>" checksum carries a URL
	// value that may itself contain colons (e.g. a port).
	checksumType, checksumVal, ok := strings.Cut(check, ":")
	if !ok {
		return fmt.Errorf(`checksum must be given as "type:value"; got %q`, check)
	}

	// A "file:<url>" checksum tells go-getter to read the checksum from a
	// remote file rather than supplying a hex digest inline, so there is no
	// digest to validate here; the getter resolves it at fetch time.
	if checksumType == "file" {
		return nil
	}

	checksumBytes, err := hex.DecodeString(checksumVal)
	if err != nil {
		return fmt.Errorf("invalid checksum: %v", err)
	}

	expectedLength := 0
	switch checksumType {
	case "md5":
		if fips140.Enabled() {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Prefix the digest with its algorithm and a colon, e.g. "sha256:<hex>".
2. Use one of md5, sha1, sha256, sha512 as the type (or "file:<url>" for remote checksum files).
3. Regenerate the checksum with a command that prints the prefixed form you can copy.

Example fix

// before
checksum = "3b5d2f..."
// after
checksum = "sha256:3b5d2f..."

_, val, ok := strings.Cut(checksum, ":")
if !ok { return fmt.Errorf("checksum %q must be type:value", checksum) }
if !validTypes[strings.Cut(checksum, ":")[0]] { return errors.New("unsupported type") }

When it happens

Trigger: checksum = "sha256abcd1234" or a bare hex digest without the "type:" prefix passed to an artifact block's checksum field.

Common situations: Users pasting just the hex digest from a release page; converting from tools that take only a digest; docs examples omitting the prefix.

Related errors

• checksum value cannot be empty
• unsupported checksum type: %s
• invalid artifact config: %v
• http_max_size not a valid size: %w
• invalid checksum: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b9a10c687eb66d2f. Report an issue: GitHub.