hashicorp/nomad · error

checksum value cannot be empty

Error message

checksum value cannot be empty

What it means

After allowing env-interpolated checksums, the artifact validator trims whitespace and requires a non-empty checksum string. An empty (or whitespace-only) checksum gives go-getter nothing to verify against, so validation fails early with this error.

Source

Thrown at nomad/structs/structs.go:9962

	return mErr.ErrorOrNil()
}

func (ta *TaskArtifact) validateChecksum() error {
	check, ok := ta.GetterOptions["checksum"]
	if !ok {
		return nil
	}

	// Job struct validation occurs before interpolation resolution can be effective.
	// Skip checking if checksum contain variable reference, and artifacts fetching will
	// eventually fail, if checksum is indeed invalid.
	if args.ContainsEnv(check) {
		return nil
	}

	check = strings.TrimSpace(check)
	if check == "" {
		return fmt.Errorf("checksum value cannot be empty")
	}

	// Cut on the first colon only: a "file:<url>" checksum carries a URL
	// value that may itself contain colons (e.g. a port).
	checksumType, checksumVal, ok := strings.Cut(check, ":")
	if !ok {
		return fmt.Errorf(`checksum must be given as "type:value"; got %q`, check)
	}

	// A "file:<url>" checksum tells go-getter to read the checksum from a
	// remote file rather than supplying a hex digest inline, so there is no
	// digest to validate here; the getter resolves it at fetch time.
	if checksumType == "file" {
		return nil
	}

	checksumBytes, err := hex.DecodeString(checksumVal)
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Provide a real checksum such as checksum = "sha256:<hex>".
2. Remove the checksum attribute entirely if you do not want verification.
3. Check the variable/template feeding the checksum so it never renders to an empty string.

Example fix

// before
artifact {
  source      = "https://example.com/app.tgz"
  destination = "local/app"
  checksum    = ""
}
// after
artifact {
  source      = "https://example.com/app.tgz"
  destination = "local/app"
  checksum    = "sha256:abc123..."
}

if err := structs.ValidateArtifactChecksum(strings.TrimSpace(checksum)); err != nil { return err } // or inline:
if strings.TrimSpace(checksum) == "" { return errors.New("checksum must not be empty") }

When it happens

Trigger: Setting checksum = "" or checksum = " " in an artifact block, or an interpolated variable (not caught by ContainsEnv) that renders empty at validate time.

Common situations: Templating pipelines that emit checksum="" when an upstream build lacks a digest file; hand-edited HCL where the checksum value was deleted but the attribute kept.

Related errors

• unsupported checksum type: %s
• http_max_size not a valid size: %w
• checksum must be given as "type:value"; got %q
• invalid checksum: %v
• invalid %s checksum: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9b4268f7b875e887. Report an issue: GitHub.