What causes "{}: source archive has no sha256 in the API" in jdx/mise?

Clear mise's Homebrew API cache and retry to refresh the metadata

jdx/mise · error · eyre::Report

{}: source archive has no sha256 in the API

Error message

{}: source archive has no sha256 in the API

What it means

Before building from source, mise requires the source archive's sha256 from the Homebrew API so the download can be verified. If the API metadata carries no checksum for the stable source, the archive cannot be trusted and check_buildable rejects the build before any work happens.

Source

Thrown at src/system/packages/brew/source.rs:74

        _ => "source-only formula, no bottles".to_string(),
    }
}

/// Reject early what the source builder cannot handle, with the reason —
/// checked before any work happens so dry-run and real runs fail alike.
pub fn check_buildable(formula: &Formula) -> Result<()> {
    let Some(src) = formula.stable_url() else {
        bail!("{}: formula has no stable source URL", formula.name);
    };
    if let Some(using) = &src.using {
        bail!(
            "{}: source uses the {using:?} download strategy, which mise cannot build from \
             (and no bottle exists for this machine)",
            formula.name,
        );
    }
    if src.checksum.is_none() {
        bail!("{}: source archive has no sha256 in the API", formula.name);
    }
    // the formula .rb must be pinned to the API snapshot's commit and
    // verifiable — evaluating a newer/unverified formula against older
    // source metadata would build the wrong thing
    if formula.ruby_source_path.is_none() {
        bail!("{}: API metadata has no ruby_source_path", formula.name);
    }
    if formula.tap_git_head.is_none() {
        bail!("{}: API metadata has no tap_git_head", formula.name);
    }
    if formula
        .ruby_source_checksum
        .as_ref()
        .and_then(|c| c.sha256.as_deref())
        .is_none()
    {
        bail!("{}: API metadata has no formula checksum", formula.name);
    }

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Clear mise's Homebrew API cache and retry to refresh the metadata
Update mise in case parsing of newer API shapes was fixed
Install via native brew, or wait until upstream metadata includes the checksum

Defensive patterns

Strategy: retry

Try / catch

match check_buildable(&formula) {
    Err(e) if e.to_string().contains("no sha256") => {
        clear_homebrew_api_cache()?;    // refresh the API snapshot
        check_buildable(&formula)        // metadata may now include the checksum
    }
    other => other,
}

Prevention

Refresh the Homebrew API cache when metadata looks incomplete after upstream bumps
Do not bypass checksum verification — install with native brew if metadata stays incomplete
Update mise when new API metadata shapes appear

When it happens

Trigger: src.checksum.is_none() for a formula that fell back to source building because the host tag had no bottle.

Common situations: Stale or partially populated Homebrew API JSON cache; upstream metadata glitches right after a formula version bump; third-party taps with lax metadata.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/074bbf39b0966f54. Report an issue: GitHub.