henrygd/beszel · error

unsupported release digest algorithm %q

Error message

unsupported release digest algorithm %q

What it means

After splitting the digest on ":", the library only supports the sha256 algorithm (compared case-insensitively). If the digest prefix names any other algorithm — md5, sha1, sha512, etc. — verification is refused because the code only knows how to compute and compare SHA-256. This guards against silently accepting a weaker or unknown hash scheme.

Source

Thrown at internal/ghupdate/checksum.go:19

package ghupdate

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"os"
	"strings"
)

func verifyAssetChecksum(path, digest string) error {
	algorithm, expectedHex, ok := strings.Cut(digest, ":")
	if !ok || algorithm == "" || expectedHex == "" {
		return fmt.Errorf("invalid release digest %q", digest)
	}
	if !strings.EqualFold(algorithm, "sha256") {
		return fmt.Errorf("unsupported release digest algorithm %q", algorithm)
	}

	expected, err := hex.DecodeString(expectedHex)
	if err != nil || len(expected) != sha256.Size {
		return fmt.Errorf("invalid SHA-256 release digest %q", digest)
	}

	file, err := os.Open(path)
	if err != nil {
		return fmt.Errorf("failed to open release for checksum verification: %w", err)
	}
	defer file.Close()

	hash := sha256.New()
	if _, err := io.Copy(hash, file); err != nil {
		return fmt.Errorf("failed to calculate release checksum: %w", err)
	}
	actual := hash.Sum(nil)

View on GitHub (pinned to b38fb7dafa)

Solutions

1. Re-publish the release asset so it carries a sha256 digest (GitHub does this automatically for release assets).
2. If you control the mirror, convert the published digest to "sha256:<hex>" format.
3. Fork/patch verifyAssetChecksum to support the algorithm you use, but prefer upgrading to sha256.

Example fix

// before
digest := "sha512:9d4e..."
// after
digest := "sha256:3f2a..." // only sha256 is accepted

algo := strings.SplitN(asset.Digest, ":", 2)[0]
if !strings.EqualFold(algo, "sha256") {
    return fmt.Errorf("unsupported digest algorithm %q; republish asset with sha256", algo)
}

updated, err := ghupdate.Update(cfg)
if err != nil && strings.Contains(err.Error(), "unsupported release digest algorithm") {
    log.Printf("release uses an unsupported hash algorithm (%v); pin to a sha256 release", err)
}

When it happens

Trigger: ghupdate.Update -> update -> verifyAssetChecksum with a release asset digest like "md5:...", "sha512:...", or "sha1:..." published on the release, typically from a manually uploaded asset or a mirror that recomputed digests with a different algorithm.

Common situations: Self-hosted release pipelines that publish md5 or sha512 checksum files; third-party forks of beszel publishing their own digest format; older release tooling predating GitHub's sha256 digest support.

Related errors

• invalid release digest %q
• invalid SHA-256 release digest %q
• release checksum mismatch: expected %s, got %s
• missing asset containing ${suffix}
• unsupported hash length: %d (expected 40 for SHA1 or 64 for

AI-assisted analysis of henrygd/beszel@b38fb7dafa (2026-08-31). Data as JSON: /api/errors/139057b9017e5409. Report an issue: GitHub.