jdx/mise · error · RuntimeError

formula has no stable sha256

Error message

formula has no stable sha256

What it means

mise's formula extractor requires the Formula subclass to record a stable sha256 checksum via the `sha256 "..."` DSL call; note the stub only stores the value when it is a String (`sha256(value) = ... if value.is_a?(String)`). If no sha256 was recorded — or it was given as `:no_check` or another non-String symbol — `klass.source_sha256` is empty and this raise fires. mise verifies source tarball integrity, so it refuses formulas without a stable checksum.

Source

Thrown at src/system/packages/brew/tap_formula_metadata.rb:218

    def livecheck(*) = nil
    def service(*) = nil
    def test(*) = nil
    def method_missing(*) = nil
    def respond_to_missing?(*) = true
  end
end

def inferred_version(url)
  basename = File.basename(url.to_s).sub(/\.(tar\.(gz|xz|bz2|zst)|tgz|txz|zip|gz)\z/i, "")
  match = basename.match(/(?:^|[-_v])([0-9]+(?:\.[0-9A-Za-z]+)+(?:[-_.][0-9A-Za-z]+)*)/)
  match && match[1]
end

eval(STDIN.read.force_encoding("UTF-8"), TOPLEVEL_BINDING, FORMULA_FILE, 1)
klass = Formula.instance_variable_get(:@subclass)
raise "no Formula subclass found" unless klass
raise "formula has no stable URL" if klass.source_url.to_s.empty?
raise "formula has no stable sha256" if klass.source_sha256.to_s.empty?
version = (klass.explicit_version || inferred_version(klass.source_url)).to_s
raise "could not infer formula version; add an explicit version declaration" if version.to_s.empty?

metadata = {
  "name" => FORMULA_NAME,
  "tap" => ENV.fetch("MISE_BREW_TAP"),
  "versions" => { "stable" => version },
  "revision" => klass.revision_value || 0,
  "keg_only" => klass.keg_only_value || false,
  "dependencies" => klass.runtime_dependencies || [],
  "build_dependencies" => klass.build_dependencies || [],
  "bottle" => {},
  "urls" => { "stable" => { "url" => klass.source_url, "checksum" => klass.source_sha256 } },
  "ruby_source_path" => ENV.fetch("MISE_BREW_SOURCE_PATH"),
  "ruby_source_checksum" => { "sha256" => ENV.fetch("MISE_BREW_SOURCE_CHECKSUM") },
  "tap_git_head" => ENV.fetch("MISE_BREW_TAP_COMMIT")
}
puts JSON.generate(metadata)

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Ensure the formula's stable spec declares `sha256 "<hex>"` as a String
2. Replace `sha256 :no_check` with the real tarball checksum (compute with `shasum -a 256 <tarball>`)
3. If sha256 lives in a conditional block, verify MISE_BREW_OS/arch env so the block runs, or hoist the declaration to the stable block
4. Refresh the tap to a revision where the formula has a valid checksum

Example fix

// before
//   stable do
//     url "https://example.com/foo-1.2.3.tar.gz"
//     sha256 :no_check
//   end
// after
//   stable do
//     url "https://example.com/foo-1.2.3.tar.gz"
//     sha256 "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
//   end

body = File.read(formula_path)
raise "formula lacks a String sha256" unless body.match?(/^\s*sha256\s+["'][0-9a-fA-F]{64}["']/)

def has_string_sha256?(formula_source)
  !formula_source[/^\s*sha256\s+["']([0-9a-fA-F]{64})["']/, 1].to_s.empty?
end

begin
  extract_formula_metadata(formula_path)
rescue RuntimeError => e
  raise unless e.message == "formula has no stable sha256"
  warn "Formula sha256 missing or symbolic (:no_check); supply a real checksum"
end

When it happens

Trigger: Formula's stable block omits `sha256`; formula uses `sha256 :no_check` (a Symbol, silently dropped by the stub); sha256 declared only inside a conditional block that did not run (wrong MISE_BREW_OS/arch); sha256 specified via an unrecognized DSL form the stub discards.

Common situations: Live/head-only formulas that skip checksums; formulas migrated to `:no_check` for checksum-upstream breakage; checksum placed inside an `on_linux`/`on_macos` branch not matching the host platform; malformed formula from an out-of-date tap checkout.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• brew-cask:{}: cask metadata has no sha256
• {name}: sha256 is {actual}, the packslip says {}
• invalid Hex OTP checksum for {release_tag}: {checksum}
• Invalid lockfile checksum for precompiled Erlang/OTP {versio
• recovery content failed verification

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/e312766942bfc42b. Report an issue: GitHub.