Invalid lockfile checksum for precompiled Erlang/OTP {versio

Error message

Invalid lockfile checksum for precompiled Erlang/OTP {version}; regenerate mise.lock with `mise lock`

What it means

On Linux installs driven by mise.lock (locked mode or when a lockfile URL exists for the platform), mise requires the erlang entry's checksum to match sha256:<64 lowercase hex>. This variant fires when a checksum is present but malformed — a hand-edited or badly merged mise.lock, or one written by an incompatible mise version. The sibling 'No lockfile checksum found' error covers the absent case; both tell you to regenerate with mise lock.

Source

Thrown at src/plugins/core/erlang.rs:829

    let checksum = matching[0]
        .get(3)
        .ok_or_else(|| eyre::eyre!("Hex OTP build record for {release_tag} has no checksum"))?;
    if !regex!(r"^[0-9a-f]{64}$").is_match(checksum) {
        bail!("invalid Hex OTP checksum for {release_tag}: {checksum}");
    }

    Ok(format!("sha256:{checksum}"))
}

#[cfg(any(linux, test))]
fn require_locked_precompiled_checksum(version: &str, checksum: Option<&str>) -> Result<String> {
    let checksum = checksum.ok_or_else(|| {
        eyre::eyre!(
            "No lockfile checksum found for precompiled Erlang/OTP {version}; regenerate mise.lock with `mise lock`"
        )
    })?;
    if !regex!(r"^sha256:[0-9a-f]{64}$").is_match(checksum) {
        bail!(
            "Invalid lockfile checksum for precompiled Erlang/OTP {version}; regenerate mise.lock with `mise lock`"
        );
    }

    Ok(checksum.to_string())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_parse_hex_build_checksum_requires_exact_publisher_record() {
        let builds = "OTP-28.5.0.4 abc 2026-07-27T13:55:40Z 34498e6287e1fbc31250d36dd88bcdb1d286cedbdd9b1a66bbc4284738d2d2eb\n\
                      OTP-28.5.0.5 def 2026-08-04T10:35:03Z e3476633cae6fef8e1bb53576832b15823f715e70e3d4d1e66a6be908804f967\n";

        assert_eq!(
            parse_hex_build_checksum(builds, "OTP-28.5.0.5").unwrap(),

View on GitHub (pinned to 6f52dcdf99)

Solutions

Regenerate the lockfile as the message says: `mise lock` (then commit it) and re-run the locked install
Inspect mise.lock around the erlang platform entry for merge-conflict markers or mangled values and fix them
Ensure everyone runs a recent mise version when writing mise.lock (`mise doctor` shows the version)

Example fix

# before
$ mise install --locked
ERROR: Invalid lockfile checksum for precompiled Erlang/OTP 27.1; regenerate mise.lock with `mise lock`

# after
$ mise lock && mise install --locked

Defensive patterns

Strategy: validation

Validate before calling

# CI gate: lockfile erlang checksums must be well-formed before --locked installs
grep -o 'checksum = "[^"]*"' mise.lock | grep -vE 'checksum = "(sha256:[0-9a-f]{64})?"' && { echo 'bad mise.lock checksum'; exit 1; } || true

Try / catch

if ! mise install --locked; then
  # regenerate lockfile (as the error instructs) and retry once
  mise lock && mise install --locked
fi

Prevention

Treat mise.lock as generated: regenerate with `mise lock` instead of hand-editing after conflicts
Run `mise lock` in CI after merging branches that both touched mise.lock

When it happens

Trigger: `mise install --locked` (or settings.locked=true) after a git merge conflict in mise.lock left a broken checksum; someone hand-pasted a checksum without the sha256: prefix or with uppercase/truncated hex; lockfile rewritten by a formatting tool.

Common situations: Teams sharing mise.lock across branches hitting conflict residue; scripts that sed-edit mise.lock; upgrading mise across versions with lockfile schema drift.

Related errors

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/50115d15b868dfbc. Report an issue: GitHub.