jdx/mise · error

Unknown checksum algorithm: {}

Error message

Unknown checksum algorithm: {}

What it means

mise verifies downloaded tool archives in ensure_checksum (src/hash.rs), which implements exactly blake3, sha512, sha384, sha256, sha224, sha1, and md5 (match arms at src/hash.rs:101-129). The bail at src/hash.rs:130 fires when the algorithm component of a checksum spec matches none of these arms, so verification aborts before any bytes are hashed.

Source

Thrown at src/hash.rs:130

        "sha224" => file_hash_prog::<Sha224>(path, pr)?,
        "sha384" => file_hash_prog::<Sha384>(path, pr)?,
        "sha1" => {
            if use_external_hasher && file::which("sha1sum").is_some() {
                let out = cmd!("sha1sum", path).read()?;
                out.split_whitespace().next().unwrap().to_string()
            } else {
                file_hash_prog::<Sha1>(path, pr)?
            }
        }
        "md5" => {
            if use_external_hasher && file::which("md5sum").is_some() {
                let out = cmd!("md5sum", path).read()?;
                out.split_whitespace().next().unwrap().to_string()
            } else {
                file_hash_prog::<Md5>(path, pr)?
            }
        }
        _ => bail!("Unknown checksum algorithm: {}", algo),
    };
    let checksum = checksum.to_lowercase();
    if actual != checksum {
        bail!(
            "Checksum mismatch for file {}:\nExpected: {algo}:{checksum}\nActual:   {algo}:{actual}",
            display_path(path)
        );
    }
    Ok(())
}

pub(crate) fn parse_shasums(text: &str) -> HashMap<String, String> {
    text.lines()
        .filter_map(|l| {
            let mut parts = l.split_whitespace();
            let hash = parts.next()?;
            let name = parts.next()?;
            // Strip coreutils binary-mode marker (e.g. "<hash> *file.tar.gz").

View on GitHub (pinned to 6f52dcdf99)

Solutions

1. Rewrite the checksum with a supported algorithm: recompute with sha256sum and store it as "sha256:<hex>" (blake3, sha512, sha384, sha256, sha224, sha1, md5 all work; write prefixes lowercase, matching the match arms).
2. Fix prefix typos: "sha-256" -> "sha256", "sha 256" -> "sha256".
3. Update mise (mise upgrade) in case the algorithm is supported in a newer release.
4. If the spec comes from the mise/aqua/ubi registry rather than your own config, open an issue or PR against that registry entry.

Example fix

# before (mise.toml / backend checksum)
checksum = "sha3-256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

# after
checksum = "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

const SUPPORTED: &[&str] = &["blake3", "sha512", "sha384", "sha256", "sha224", "sha1", "md5"];

fn checksum_spec_is_supported(spec: &str) -> bool {
    match spec.split_once(':') {
        Some((algo, hex)) => !hex.is_empty() && SUPPORTED.contains(&algo.to_ascii_lowercase().as_str()),
        None => false,
    }
}

// gate before mise install / mise lock touches the spec
assert!(checksum_spec_is_supported(&spec), "unsupported algorithm in checksum spec: {spec}");

When an install call returns Err, match the message for "Unknown checksum algorithm" first: it is deterministic, so retrying cannot help. Surface the rejected prefix and the supported list to the user instead of falling back to skipping verification.

When it happens

Trigger: A checksum spec whose algorithm prefix is unrecognized reaches ensure_checksum: "crc32:...", "sha3-256:...", or "blake2b:..." in mise.toml, a custom backend (http:, s3:, github:) checksum field, an aqua/ubi registry entry, or a lockfile; a typo such as "sha-256:"; or a value written by a newer mise release that added an algorithm this build predates.

Common situations: Hand-authoring tool metadata and copying a blake2/crc32/sha3 digest from a release page; scripts that generate checksums with b2sum or cksum; an older pinned mise reading registry entries that started using a newer algorithm.

Related errors

• invalid task action identity
• Invalid platform format '{}'. Expected 'os-arch' or 'os-arch
• invalid bootstrap secret name '{name}': use ASCII letters, d
• bootstrap service '{name}' cannot be both masked and running
• bootstrap service '{name}' cannot be both masked and enabled

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/6cb0de20122ae0de. Report an issue: GitHub.