jdx/mise · error

Invalid checksum format: {}

Error message

Invalid checksum format: {}

What it means

verify_checksum_str (src/backend/static_helpers.rs:906) expects a checksum string in "<algorithm>:<hex-hash>" form (e.g. "sha256:abcd...") and splits it on ':'. If no colon is present the string is not a parseable checksum and the tool bails, refusing to verify or guess the algorithm.

Source

Thrown at src/backend/static_helpers.rs:906

                "Size mismatch: expected {}, got {}",
                expected_size,
                actual_size
            );
        }
    }

    Ok(())
}

pub(crate) fn verify_checksum_str(
    file_path: &Path,
    checksum: &str,
    pr: Option<&dyn SingleReport>,
) -> Result<()> {
    if let Some((algo, hash_str)) = checksum.split_once(':') {
        hash::ensure_checksum(file_path, hash_str, pr, algo)?;
    } else {
        bail!("Invalid checksum format: {}", checksum);
    }
    Ok(())
}

/// File extensions that indicate non-binary files.
const SKIP_EXTENSIONS: &[&str] = &[".txt", ".md", ".json", ".yml", ".yaml"];

/// File names (case-insensitive) that should be skipped when looking for executables.
const SKIP_FILE_NAMES: &[&str] = &["LICENSE", "README"];

/// Checks if a file should be skipped when searching for executables.
///
/// # Arguments
/// * `file_name` - The file name to check
/// * `strict` - If true, also checks against SKIP_FILE_NAMES and README.* patterns
///
/// # Returns
/// * `true` if the file should be skipped (not a binary)

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Rewrite the checksum to "algo:hash" form, e.g. "sha256:<hex>".
2. Check which algorithm the upstream project publishes (sha256/sha512/sha1) and prefix it accordingly.
3. If the value came from a lockfile or hand-edited config, regenerate it instead of editing manually.
4. If you wrote the backend/plugin, fix the checksum template to emit the algorithm prefix.

Example fix

// before (config)
checksum = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
// after
checksum = "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

// validate checksum string before handing it to the backend
fn is_valid_checksum(s: &str) -> bool {
    s.split_once(':')
        .map(|(algo, hash)| ["sha256", "sha512", "sha1", "blake3"].contains(&algo) && !hash.is_empty())
        .unwrap_or(false)
}

match verify_artifact(&file, &checksum, pr) {
    Err(e) if e.to_string().contains("Invalid checksum format") => fix_checksum_format(&checksum)?,
    other => other?,
}

When it happens

Trigger: A backend/config "checksum" value like "d41d8cd98f00b204e9800998ecf8427e" or "sha256 abcd" (space instead of colon) is passed to verify_checksum_str via verify_artifact.

Common situations: Hand-edited tool config or lockfile with a bare hash; copying a checksum line from an upstream checksums file that uses spaces; writing a custom backend template with the wrong checksum format.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid checksum: {checksum}
• Invalid checksum: {checksum}
• {option}: '{name}' must be a plain file name (no path separa
• {option}: '{path}' must be a safe relative path (no absolute
• Invalid checksum: {platform_key}

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/8ccc8e8622de39b2. Report an issue: GitHub.