kubernetes/kops · error

unable to parse asset hash %q: %w

Error message

unable to parse asset hash %q: %w

What it means

When a known hash string is supplied alongside an asset URL, buildFileAsset converts it with hashing.FromString. If the string is not a recognized hash format (expected like 'sha256:<hex>' or a valid hex digest), this wrapped error is returned. It prevents propagating an unusable hash into the asset builder where it would break integrity verification.

Source

Thrown at pkg/nodemodel/wellknownassets/containerd.go:105

		u = fmt.Sprintf(containerdReleaseUrlArm64, version, version)
	default:
		return nil, fmt.Errorf("unknown arch: %q", arch)
	}

	return url.Parse(u)
}

func buildFileAsset(assetBuilder *assets.AssetBuilder, canonicalURL string, knownHashString string) (*assets.FileAsset, error) {
	u, err := url.Parse(canonicalURL)
	if err != nil {
		return nil, fmt.Errorf("unable to parse asset URL %q: %w", canonicalURL, err)
	}

	var knownHash *hashing.Hash
	if knownHashString != "" {
		h, err := hashing.FromString(knownHashString)
		if err != nil {
			return nil, fmt.Errorf("unable to parse asset hash %q: %w", knownHashString, err)
		}
		knownHash = h
	}

	asset, err := assetBuilder.RemapFile(u, knownHash)
	if err != nil {
		return nil, fmt.Errorf("unable to remap asset: %w", err)
	}

	return asset, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the hash to the full sha256 hex digest of the asset tarball, e.g. sha256:<64 hex chars>
2. Recompute the hash: curl -L <url> | sha256sum and use the output
3. Verify no truncation/whitespace was introduced when pasting the checksum into the spec

Example fix

// before
hash: "e3b0c442"
// after
hash: "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

hex := strings.TrimPrefix(hashString, "sha256:")
if len(hex) != 64 {
    return fmt.Errorf("asset hash must be 64 hex chars (sha256), got %d", len(hex))
}
if _, err := hex.DecodeString(hex); err != nil {
    return fmt.Errorf("asset hash is not valid hex: %v", err)
}

asset, err := wellknownassets.FindContainerdAsset(ig, assetBuilder, arch)
if err != nil && strings.Contains(err.Error(), "unable to parse asset hash") {
    return fmt.Errorf("recompute the sha256 sum of the asset and update the spec: %w", err)
}

When it happens

Trigger: FindContainerdAsset/FindNerdctlAsset/FindRuncAsset are called with knownHashString values that are empty-ish, wrong length, non-hex, or missing the algorithm prefix — e.g. 'abc', 'sha512:...' when only sha256 supported, or a base64 digest.

Common situations: Users copy the wrong checksum column; checksum truncated by copy-paste; using a SHA512 sum where a SHA256 is expected; templating substituting an empty value that still passes the != "" check as whitespace.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• error hashing manifest: %v
• error hashing manifest location: %v
• unable to find any containerd binaries in assets
• error finding contained version
• error parsing container runtime version %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a1c2fd3ed1268a52. Report an issue: GitHub.