hashicorp/nomad · error

invalid %s checksum: %v

Error message

invalid %s checksum: %v

What it means

After hex-decoding, the digest byte length must match the chosen algorithm exactly (md5:16, sha1:20, sha256:32, sha512:64 bytes). A hex-valid but wrong-length value fails with 'invalid <type> checksum: <value>'.

Source

Thrown at nomad/structs/structs.go:10005

		if fips140.Enabled() {
			return fmt.Errorf("md5 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = md5.Size
	case "sha1":
		if fips140.Enabled() {
			return fmt.Errorf("sha1 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = sha1.Size
	case "sha256":
		expectedLength = sha256.Size
	case "sha512":
		expectedLength = sha512.Size
	default:
		return fmt.Errorf("unsupported checksum type: %s", checksumType)
	}

	if len(checksumBytes) != expectedLength {
		return fmt.Errorf("invalid %s checksum: %v", checksumType, checksumVal)
	}

	return nil
}

const (
	ConstraintDistinctProperty  = "distinct_property"
	ConstraintDistinctHosts     = "distinct_hosts"
	ConstraintRegex             = "regexp"
	ConstraintVersion           = "version"
	ConstraintSemver            = "semver"
	ConstraintSetContains       = "set_contains"
	ConstraintSetContainsAll    = "set_contains_all"
	ConstraintSetContainsAny    = "set_contains_any"
	ConstraintAttributeIsSet    = "is_set"
	ConstraintAttributeIsNotSet = "is_not_set"
)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Re-run the correct checksum command for the declared algorithm (e.g. sha256sum for type sha256).
2. Ensure the hex string has the exact expected length (32 chars md5, 40 sha1, 64 sha256, 128 sha512).
3. Fix the type prefix if the digest length is right but the label is wrong.

Example fix

// before
checksum = "sha512:3b5d2f..."  # only 64 hex chars (a sha256)
// after
checksum = "sha256:3b5d2f..."  # 64 hex chars, correctly typed

want := map[string]int{"md5":32,"sha1":40,"sha256":64,"sha512":128}
type, val, _ := strings.Cut(checksum, ":")
if n := want[type]; n > 0 && len(val) != n {
    return fmt.Errorf("%s checksum must be %d hex chars, got %d", type, n, len(val))
}

When it happens

Trigger: Providing a sha256-length digest labeled as sha512, a truncated digest (e.g. first 16 chars of a sha256), or swapping type/value between artifact entries.

Common situations: Truncated hashes from log output; hand-rolled string slicing; mislabeling the algorithm when copying digests from release pages.

Related errors

• checksum value cannot be empty
• invalid checksum: %v
• unsupported checksum type: %s
• missing secret ID
• namespace cannot contain template delimiters or parenthesis

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8aa4a217e5708675. Report an issue: GitHub.