hasura/graphql-engine · error

`sha256` value %s is not valid, must match pattern %s

Error message

`sha256` value %s is not valid, must match pattern %s

What it means

validatePlatform requires the manifest's sha256 field to be a valid hex SHA-256 digest (64 hex characters matching sha256Pattern in cli/plugins/util.go). The sum is later used by download.NewSha256Verifier to authenticate the downloaded archive, so a malformed value is rejected up front.

Source

Thrown at cli/plugins/util.go:87

	return true
}

// validatePlatform checks Platform for structural validity.
func validatePlatform(p Platform) error {
	var op errors.Op = "plugins.validatePlatform"
	if p.URI == "" {
		return errors.E(op, "`uri` has to be set")
	}

	if p.Sha256 == "" {
		return errors.E(op, "`sha256` sum has to be set")
	}

	if !isValidSHA256(p.Sha256) {
		return errors.E(
			op,
			fmt.Errorf(
				"`sha256` value %s is not valid, must match pattern %s",
				p.Sha256,
				sha256Pattern,
			),
		)
	}

	if p.Bin == "" {
		return errors.E(op, "`bin` has to be set")
	}

	err := validateFiles(p.Files)
	if err != nil {
		return errors.E(op, fmt.Errorf("`files` is invalid: %w", err))
	}

	return nil
}

View on GitHub (pinned to 724551b9ae)

Solutions

1. Recompute the digest with sha256sum <archive> and paste ONLY the 64 lowercase hex characters.
2. Remove any whitespace, filename suffix, 'sha256:' prefix, or Base64 encoding from the value.
3. Verify length == 64 and all chars are [0-9a-f] before publishing the manifest.

Example fix

// before
"sha256": "sha256:9f2a..."

// after
"sha256": "9f2a86e0aa2b6c3ed54eb0ec2b2d80d0e2c8e41b0d1c9c58e5a2e1ff8bf2a7f14"

var sha256Re = regexp.MustCompile(`^[a-f0-9]{64}$`)

func isValidSum(s string) bool { return sha256Re.MatchString(s) }

func isHexSha256(s string) bool {
	if len(s) != 64 {
		return false
	}
	for _, c := range s {
		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')) {
			return false
		}
	}
	return true
}

When it happens

Trigger: A platforms[] entry with a sha256 that is empty (but the earlier "has to be set" check passed to something invalid), shorter/longer than 64 chars, containing uppercase or non-hex characters, or a Base64-encoded digest instead of hex.

Common situations: Copy-pasting a truncated hash; pasting a Base64 checksum from a release page; including the leading filename part of `sha256sum` output ("abc... file.tar.gz") instead of just the hex digest.

Related errors

• the plugin name %q is not allowed, must match %q
• plugin should be named %q, not %q
• platform (%+v) is badly constructed: %w
• `files` is invalid: %w
• plugin %q does not offer installation for this platform

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/c8bad7fcbb79df7d. Report an issue: GitHub.