What causes "{}: source archive has no sha256 in the API" in jdx/mise?

Prefer installing via bottle — use a supported platform or a formula version with bottles

: source archive has no sha256 in the API

Error message

{}: source archive has no sha256 in the API

What it means

mise verifies source archives against the sha256 published in the Homebrew API before building. If the API metadata contains no checksum for the stable source, mise refuses to build because it cannot verify the download.

Solutions

Prefer installing via bottle — use a supported platform or a formula version with bottles
Verify the API JSON actually has all_dependencies/source checksums; if not, this formula is not source-buildable via mise — use brew directly
Pick a different tool version that has a proper source checksum
File an issue with homebrew-core if the metadata is genuinely malformed

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

curl -s https://formulae.brew.sh/api/formula/<name>.json | jq -e '.urls.stable.checksum' >/dev/null && echo ok || echo 'no source checksum'

Try / catch

catch 'source archive has no sha256 in the API' => use a bottle-backed version/platform or install via brew directly

Prevention

Prefer formulas/versions with bottles for your platform
Refresh API metadata before installs
Avoid bleeding-edge formula versions that may lack source metadata
Record working tool versions in mise config for reproducibility

When it happens

Trigger: `check_buildable` finds `src.checksum.is_none()` for a formula being built from source (no bottle available for the host).

Common situations: Formulas whose API JSON lacks a checksum (unusual metadata, very new or legacy entries); building on platforms that fall through to source for formulas that never publish source checksums.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/074bbf39b0966f54. Report an issue: GitHub.

Appendix: source

Thrown at src/system/packages/brew/source.rs:75

        _ => "source-only formula, no bottles".to_string(),
    }
}

/// Reject early what the source builder cannot handle, with the reason —
/// checked before any work happens so dry-run and real runs fail alike.
pub(super) fn check_buildable(formula: &Formula) -> Result<()> {
    let Some(src) = formula.stable_url() else {
        bail!("{}: formula has no stable source URL", formula.name);
    };
    if let Some(using) = &src.using {
        bail!(
            "{}: source uses the {using:?} download strategy, which mise cannot build from \
             (and no bottle exists for this machine)",
            formula.name,
        );
    }
    if src.checksum.is_none() {
        bail!("{}: source archive has no sha256 in the API", formula.name);
    }
    // the formula .rb must be pinned to the API snapshot's commit and
    // verifiable — evaluating a newer/unverified formula against older
    // source metadata would build the wrong thing
    if formula.ruby_source_path.is_none() {
        bail!("{}: API metadata has no ruby_source_path", formula.name);
    }
    if formula.tap_git_head.is_none() {
        bail!("{}: API metadata has no tap_git_head", formula.name);
    }
    if formula
        .ruby_source_checksum
        .as_ref()
        .and_then(|c| c.sha256.as_deref())
        .is_none()
    {
        bail!("{}: API metadata has no formula checksum", formula.name);
    }

View on GitHub (pinned to 533346cc37)