hashicorp/packer · error

failed to download release checksums: %w

Error message

failed to download release checksums: %w

What it means

Wrapped when downloadChecksumFile fails to fetch the packer_<v>_SHA256SUMS file. This includes request build errors, network errors, non-200 HTTP status, read errors, or an empty response body. Without the checksums file the downloaded zip cannot be verified, so the operation aborts (and is retried up to 3 times).

Source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:251

		zipURL := fmt.Sprintf("%s/packer/%s/%s", base, v, fileName)
		shaSumsURL := fmt.Sprintf("%s/packer/%s/packer_%s_SHA256SUMS", base, v, v)

		log.Printf("[INFO] Downloading and verifying Packer %s for %s/%s...", v, goos, goarch)

		candidateZipPath, err := downloadURLToTempFile(ctx, client, zipURL, ".zip")
		if err != nil {
			return fmt.Errorf("failed to download Packer release zip: %w", err)
		}
		keepCandidate := false
		defer func() {
			if !keepCandidate {
				_ = os.Remove(candidateZipPath)
			}
		}()

		sumsContent, err := downloadChecksumFile(ctx, client, shaSumsURL)
		if err != nil {
			return fmt.Errorf("failed to download release checksums: %w", err)
		}

		expectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)
		if err != nil {
			return fmt.Errorf("failed to resolve expected checksum: %w", err)
		}

		actualSHA, err := fileSHA256(candidateZipPath)
		if err != nil {
			return err
		}

		if !strings.EqualFold(expectedSHA, actualSHA) {
			return fmt.Errorf("checksum mismatch for %s: expected %s, got %s", fileName, expectedSHA, actualSHA)
		}

		// Validate the expected binary exists inside the archive.
		binaryName := "packer"

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Re-run the build (retried automatically 3x); check status of releases.hashicorp.com for outages.
2. Curl the SHA256SUMS URL directly to see the raw HTTP status returned.
3. Fix proxy/firewall rules if the block page or empty body comes from an intermediary.
4. If persistent, pin/use a pre-downloaded Packer binary instead of the auto-download path.

sumsURL := fmt.Sprintf("https://releases.hashicorp.com/packer/%s/packer_%s_SHA256SUMS", v, v)
resp, err := http.Get(sumsURL)
if err != nil {
	return err
}
body, _ := io.ReadAll(resp.Body)
resp.Body.Close()
if resp.StatusCode != 200 || len(bytes.TrimSpace(body)) == 0 {
	return fmt.Errorf("SHA256SUMS unavailable or empty (HTTP %d)", resp.StatusCode)
}

if err := run(); err != nil {
	if strings.Contains(err.Error(), "failed to download release checksums") {
		time.Sleep(30 * time.Second) // transient CDN blips usually clear
		return run()
	}
}

When it happens

Trigger: downloadChecksumFile(ctx, client, shaSumsURL) errors: http.NewRequestWithContext fails, client.Do fails, HTTP status != 200 for packer_<v>_SHA256SUMS, io.ReadAll fails, or the body is empty/whitespace.

Common situations: Transient HTTP errors from releases.hashicorp.com right after a new version ships; network outage between zip download and checksum download; corporate proxy returning an empty body or block page; misconfigured release base URL.

Related errors

• Error reading checksum file: %s
• empty response body for %s
• failed to download Packer release zip: %w
• request GitHub OIDC token: %w
• Failed to hash: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/0371a147a431b943. Report an issue: GitHub.