hashicorp/packer · error

failed to resolve expected checksum: %w

Error message

failed to resolve expected checksum: %w

What it means

Wrapped when expectedZipSHA256FromSums cannot find a valid SHA256 entry for the target zip in the downloaded SHA256SUMS content. Either no line's filename matches packer_<v>_<goos>_<goarch>.zip (after trimming a leading '*'), or the matched hash is not 64 hex characters.

Source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:256

		candidateZipPath, err := downloadURLToTempFile(ctx, client, zipURL, ".zip")
		if err != nil {
			return fmt.Errorf("failed to download Packer release zip: %w", err)
		}
		keepCandidate := false
		defer func() {
			if !keepCandidate {
				_ = os.Remove(candidateZipPath)
			}
		}()

		sumsContent, err := downloadChecksumFile(ctx, client, shaSumsURL)
		if err != nil {
			return fmt.Errorf("failed to download release checksums: %w", err)
		}

		expectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)
		if err != nil {
			return fmt.Errorf("failed to resolve expected checksum: %w", err)
		}

		actualSHA, err := fileSHA256(candidateZipPath)
		if err != nil {
			return err
		}

		if !strings.EqualFold(expectedSHA, actualSHA) {
			return fmt.Errorf("checksum mismatch for %s: expected %s, got %s", fileName, expectedSHA, actualSHA)
		}

		// Validate the expected binary exists inside the archive.
		binaryName := "packer"
		if goos == "windows" {
			binaryName = "packer.exe"
		}

		zr, err := zip.OpenReader(candidateZipPath)

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the SHA256SUMS file actually lists packer_<v>_<goos>_<goarch>.zip: curl the shaSumsURL and grep for the filename.
2. Check the exact version string being used in the URL (from logs) matches the artifacts published for that release.
3. Retry later if a release was just cut — artifacts and checksums can be briefly inconsistent.
4. If the format changed upstream, update Packer/the provisioner to a version with matching parsing logic.

sums, err := fetch(sumsURL)
line := fmt.Sprintf("%s  packer_%s_%s_%s.zip", shaHex, v, goos, goarch)
if !strings.Contains(sums, line) && !strings.Contains(sums, "*packer_"+v+"_"+goos+"_"+goarch+".zip") {
	return fmt.Errorf("SHA256SUMS does not list an entry for %s/%s; artifacts may be unpublished", goos, goarch)
}

When it happens

Trigger: expectedZipSHA256FromSums(sumsContent, fileName) returns an error: 'checksum for <file> not found in SHA256SUMS' because fileName is absent, or 'invalid SHA256 checksum format' because fields[0] fails isValidSHA256Hex.

Common situations: Version string from the index does not exactly match the artifacts published for that version (filename mismatch, e.g. naming scheme change); SHA256SUMS file format changed; corrupted/truncated checksums body; unusual GOOS/GOARCH with no published zip.

Related errors

• checksum for %s not found in SHA256SUMS
• ssh_private_ip is not a boolean, %s
• unsupported reftype %q, must be either 'data', 'local' or 'v
• malformed datasource reference %q, data sources must be comp
• decode attestation envelope %q: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c159ab3018556791. Report an issue: GitHub.