no checksum entry found for {filename} in checksum file

Error message

no checksum entry found for {filename} in checksum file

What it means

When verifying a download against an aqua checksum file that lists one checksum per line, mise applies the checksum_file pattern's `file` regex to each line to find the entry whose captured filename matches the downloaded asset. If no line's captured filename equals the expected filename, it errors instead of guessing, because using another entry's checksum would produce a wrong-but-valid-looking verification.

Source

Thrown at src/backend/aqua.rs:2420

    /// Parse a checksum from checksum file content for a specific filename.
    fn parse_checksum_from_content(
        &self,
        content: &str,
        checksum_config: &AquaChecksum,
        filename: &str,
    ) -> Result<String> {
        let mut checksum_file = content.to_string();

        if checksum_config.file_format() == "regexp" {
            let pattern = checksum_config.pattern();
            if let Some(file_pattern) = &pattern.file {
                let re = regex::Regex::new(file_pattern.as_str())?;
                let Some(line) = checksum_file
                    .lines()
                    .find(|l| re.captures(l).is_some_and(|c| c[1].to_string() == filename))
                else {
                    bail!("no checksum entry found for {filename} in checksum file");
                };
                checksum_file = line.to_string();
            }
            let re = regex::Regex::new(pattern.checksum.as_str())?;
            if let Some(caps) = re.captures(checksum_file.as_str()) {
                checksum_file = caps[1].to_string();
            } else {
                debug!(
                    "no checksum found matching {} in checksum file",
                    pattern.checksum
                );
            }
        }

        // Standard format: "<hash>  <filename>" or "<hash> *<filename>"
        let entries = checksum_file
            .lines()
            .filter_map(|l| {

View on GitHub (pinned to afd2eddd3a)

Solutions

Update mise so the embedded aqua registry carries the corrected checksum file pattern for this package
Verify the asset filename actually downloaded matches what the registry's file regex expects; pin a version whose assets match
If you author the aqua package config, fix the `file` regex so group 1 captures the exact asset filename
As a workaround, disable strict checksum lookup for this tool via mise settings only if you accept unverified downloads

Example fix

# before (aqua package checksum config — pattern misses arm64 assets)
file: '(?m)^.*\n([0-9a-f]{64})  {{.Filename}}'

# after — capture the filename of every asset line
file: '(?m)^[0-9a-f]{64}\s+(.*{{.Version}}.*)$'

Defensive patterns

Strategy: validation

Validate before calling

// pre-check that the checksum file contains an entry for the expected asset
const cs = await fetch(checksumUrl).then(r => r.text());
const assetName = `tool-${version}-${os}-${arch}.tar.gz`;
if (!cs.split(/\r?\n/).some(l => l.trimEnd().endsWith(assetName))) {
  console.warn(`checksum file lacks an entry for ${assetName}; verification will fail`);
}

Try / catch

try {
  await $`mise install aqua:owner/repo`;
} catch (e) {
  if (String(e).includes("no checksum entry found")) {
    // clear cache and retry once; then pin a matching version
    await $`mise cache clean`;
    await $`mise install aqua:owner/repo@${knownGoodVersion}`;
  } else throw e;
}

Prevention

Pin tool versions whose release assets you have verified are listed in the checksum file
After upstream releases, check whether asset names changed before upgrading pins
Keep mise updated so registry checksum patterns are corrected upstream

When it happens

Trigger: Running checksum verification for an aqua package whose checksum file uses a `file` pattern regex that (a) doesn't capture group 1 at all, (b) captures a filename that differs from the asset's actual filename (e.g. different archive suffix, version-renamed asset), or (c) simply lacks a line for this asset's filename.

Common situations: Upstream renamed release assets between versions so the old file pattern no longer matches; the aqua package's checksum configuration has a regex capturing the wrong field; platform-specific assets (e.g. `-arm64` suffix) not covered by the pattern.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/c8faf0f54943d3c0. Report an issue: GitHub.