jdx/mise · error · eyre::Report

Invalid checksum: {checksum}

Error message

Invalid checksum: {checksum}

What it means

verify_additional_artifact_checksum() verifies a downloaded additional artifact against the checksum stored in the lock entry. Checksums must be `algorithm:value` strings (e.g. `blake3:...`, `sha256:...`); split_once(':') failing means the stored string has no algorithm prefix and cannot be parsed or verified.

Source

Thrown at src/backend/github.rs:1585

        self.install_additional_archive(&tv.install_path(), &file_path, Some(ctx.pr.as_ref()))?;

        if let Some(bins) = opts.filter_bins() {
            self.create_symlink_bin_dir(tv, bins)?;
        }
        Ok(())
    }

    fn verify_additional_artifact_checksum(
        &self,
        ctx: &InstallContext,
        file_path: &Path,
        artifact: &mut ArtifactInfo,
    ) -> Result<()> {
        let filename = file_path.file_name().unwrap_or_default().to_string_lossy();
        if let Some(checksum) = &artifact.checksum {
            ctx.pr.set_message(format!("checksum {filename}"));
            let Some((algorithm, expected)) = checksum.split_once(':') else {
                eyre::bail!("Invalid checksum: {checksum}");
            };
            crate::hash::ensure_checksum(file_path, expected, Some(ctx.pr.as_ref()), algorithm)?;
        } else if Settings::get().lockfile_enabled() {
            ctx.pr.set_message(format!("generate checksum {filename}"));
            let hash = crate::hash::file_hash_blake3(file_path, Some(ctx.pr.as_ref()))?;
            artifact.checksum = Some(format!("blake3:{hash}"));
        }

        if let Some(expected_size) = artifact.size {
            let actual_size = file_path.metadata()?.len();
            if actual_size != expected_size {
                eyre::bail!(
                    "Size mismatch for {}: expected {}, got {}",
                    filename,
                    expected_size,
                    actual_size
                );
            }

View on GitHub (pinned to 6f52dcdf99)

Solutions

1. Edit mise.lock so the checksum reads `algorithm:digest` (e.g. `sha256:e3b0c...`)
2. Delete the stale lock entry and regenerate with `mise lock`
3. Never hand-paste bare digests; let mise generate blake3 checksums itself

Example fix

# before (mise.lock)
checksum = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
# after
checksum = "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

# lint mise.lock checksums for algorithm prefixes before install
yq '.tools[].lock_platforms[].checksum' mise.lock | grep -vE '^[a-z0-9]+:' && echo 'checksum missing algorithm prefix' || echo ok

When it happens

Trigger: A mise.lock entry (or config supplying a checksum) contains a bare hex digest like `e3b0c44298fc...` without the `sha256:` / `blake3:` prefix, and mise (with lockfile verification enabled) downloads that additional artifact for a github: tool.

Common situations: Hand-edited lockfiles where someone pasted just the digest from a SHA256SUMS file; lockfile entries written by older mise versions or external tools; copy-pasting checksums from release notes that omit the algorithm.

Related errors

• Invalid checksum: {checksum}
• No matching complete lockfile artifact list found for {} on
• Size mismatch for {}: expected {}, got {}
• Invalid lockfile checksum for precompiled Erlang/OTP {versio
• additional asset '{}' is not an archive

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/d3079024dd7a4256. Report an issue: GitHub.