hashicorp/nomad · error

invalid checksum: %v

Error message

invalid checksum: %v

What it means

The value part of the "type:value" checksum must be a valid hex-encoded digest. hex.DecodeString fails on non-hex characters or an odd-length string, and the underlying decode error is wrapped as 'invalid checksum: %v'.

Source

Thrown at nomad/structs/structs.go:9981

	}

	// Cut on the first colon only: a "file:<url>" checksum carries a URL
	// value that may itself contain colons (e.g. a port).
	checksumType, checksumVal, ok := strings.Cut(check, ":")
	if !ok {
		return fmt.Errorf(`checksum must be given as "type:value"; got %q`, check)
	}

	// A "file:<url>" checksum tells go-getter to read the checksum from a
	// remote file rather than supplying a hex digest inline, so there is no
	// digest to validate here; the getter resolves it at fetch time.
	if checksumType == "file" {
		return nil
	}

	checksumBytes, err := hex.DecodeString(checksumVal)
	if err != nil {
		return fmt.Errorf("invalid checksum: %v", err)
	}

	expectedLength := 0
	switch checksumType {
	case "md5":
		if fips140.Enabled() {
			return fmt.Errorf("md5 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = md5.Size
	case "sha1":
		if fips140.Enabled() {
			return fmt.Errorf("sha1 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = sha1.Size
	case "sha256":
		expectedLength = sha256.Size
	case "sha512":
		expectedLength = sha512.Size

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Regenerate the digest in lowercase hex, e.g. sha256sum file.
2. Ensure the value length is even and contains only [0-9a-fA-F].
3. Trim whitespace/quotes; if you have base64, convert it to hex first.

Example fix

// before
checksum = "sha256:YWJjZGVm"  # base64
// after
checksum = "sha256:e80b5017098950fc58aad83c8c14978e..."  # hex

if _, err := hex.DecodeString(checksumVal); err != nil {
    return fmt.Errorf("checksum value must be hex: %v", err)
}

When it happens

Trigger: checksum = "sha256:xyz" (non-hex characters), an odd number of hex digits, stray whitespace/quotes inside the value, or a base64 digest pasted where hex is expected.

Common situations: Copying a base64 digest from CI output instead of hex; truncated or concatenated digests; hidden whitespace from copy-paste.

Related errors

• checksum value cannot be empty
• unsupported checksum type: %s
• invalid %s checksum: %v
• missing secret ID
• namespace cannot contain template delimiters or parenthesis

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/056c422b48ebf1a6. Report an issue: GitHub.