jdx/mise · error

Invalid checksum format

Error message

Invalid checksum format: {}

What it means

verify_checksum_str expects the configured checksum in 'algo:hash' form (e.g. sha256:abcd...). If split_once(':') finds no colon, the string is not a parseable algo+hash pair, so mise rejects it before any hashing happens.

Solutions

1. Prefix the digest with its algorithm: 'sha256:<hex>'
2. Check the source metadata file's documented checksum format
3. Regenerate the checksum with shasum -a 256 and format it as algo:hash

Example fix

// before
download.checksum = '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'
// after
download.checksum = 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'

// validate checksum format before configuring
echo "$CHECKSUM" | grep -Eq '^(sha256|sha512|sha1|md5):[0-9a-fA-F]+$' || echo "must be algo:hash"

When it happens

Trigger: verify_artifact calls verify_checksum_str with a checksum string lacking the ':' separator — e.g. metadata/config supplies a bare hex digest or a plain filename instead of 'sha256:<hex>'.

Common situations: Copy-pasting only the digest from a release page into a config that expects the algo prefix; writing the sha256sums file line verbatim (which separates with spaces, not colons); hand-editing tool metadata.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• # : malformed sha256
• # : missing sha256
• Invalid checksum
• invalid compose dependency
• invalid Hex OTP checksum for

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/8ccc8e8622de39b2. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/static_helpers.rs:906

                "Size mismatch: expected {}, got {}",
                expected_size,
                actual_size
            );
        }
    }

    Ok(())
}

pub(crate) fn verify_checksum_str(
    file_path: &Path,
    checksum: &str,
    pr: Option<&dyn SingleReport>,
) -> Result<()> {
    if let Some((algo, hash_str)) = checksum.split_once(':') {
        hash::ensure_checksum(file_path, hash_str, pr, algo)?;
    } else {
        bail!("Invalid checksum format: {}", checksum);
    }
    Ok(())
}

/// File extensions that indicate non-binary files.
const SKIP_EXTENSIONS: &[&str] = &[".txt", ".md", ".json", ".yml", ".yaml"];

/// File names (case-insensitive) that should be skipped when looking for executables.
const SKIP_FILE_NAMES: &[&str] = &["LICENSE", "README"];

/// Checks if a file should be skipped when searching for executables.
///
/// # Arguments
/// * `file_name` - The file name to check
/// * `strict` - If true, also checks against SKIP_FILE_NAMES and README.* patterns
///
/// # Returns
/// * `true` if the file should be skipped (not a binary)

View on GitHub (pinned to 533346cc37)