multica-ai/multica · error

checksum for %q not found in manifest

Error message

checksum for %q not found in manifest

What it means

The checksums.txt manifest parsed cleanly, but no line's filename field matched the selected asset name (the same name findReleaseAsset chose, e.g. multica-cli-1.2.3-darwin-arm64.tar.gz). The function deliberately errors rather than returning empty so a wrong manifest or typo fails closed instead of silently disabling verification.

Source

Thrown at server/internal/cli/update.go:209

	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		fields := strings.Fields(line)
		// GoReleaser's default separator is two spaces; some tools use one
		// or pad with tabs. strings.Fields handles all of those at once.
		if len(fields) < 2 {
			continue
		}
		if fields[1] == assetName {
			return strings.ToLower(fields[0]), nil
		}
	}
	if err := scanner.Err(); err != nil {
		return "", fmt.Errorf("read checksum manifest: %w", err)
	}
	return "", fmt.Errorf("checksum for %q not found in manifest", assetName)
}

// verifyAssetSHA256 returns nil when the SHA-256 of data matches the lowercase
// hex expected value, or an error otherwise. The error includes both digests
// so a corrupted asset is diagnosable from the log without re-downloading.
func verifyAssetSHA256(data []byte, expectedHex, assetName string) error {
	if expectedHex == "" {
		return fmt.Errorf("empty expected checksum for %q", assetName)
	}
	sum := sha256.Sum256(data)
	actual := hex.EncodeToString(sum[:])
	if !strings.EqualFold(actual, expectedHex) {
		return fmt.Errorf("checksum mismatch for %q: expected %s, got %s", assetName, expectedHex, actual)
	}
	return nil
}

func fetchReleaseByTag(tag string) (*GitHubRelease, error) {

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Open checksums.txt for the target release and confirm the exact filename it lists for your platform
2. Align the two naming schemes: regenerate the release so the manifest covers every published asset name
3. If a fallback archive is needed, also append its checksum line to checksums.txt before publishing
4. Update to the latest release, where the versioned scheme is consistent across assets and manifest

Example fix

# checksums.txt — before (missing versioned asset)
abc...  multica_darwin_arm64.tar.gz

# after (both schemes covered)
abc...  multica_darwin_arm64.tar.gz
def...  multica-cli-1.2.3-darwin-arm64.tar.gz

lines := strings.Split(string(manifest), "\n")
found := false
for _, l := range lines {
	fields := strings.Fields(l)
	if len(fields) >= 2 && fields[1] == assetName { found = true }
}
if !found { /* manifest does not cover this asset; refuse download */ }

sum, err := cli.ParseChecksumManifest(manifest, assetName)
if err != nil && strings.Contains(err.Error(), "not found in manifest") {
	// naming mismatch between asset and manifest; use a release where they align
}

When it happens

Trigger: The manifest comes from a different release than the asset (version mismatch), the asset name in the manifest uses a different naming scheme than the archive (e.g. legacy multica_darwin_arm64.tar.gz in checksums but versioned name matched for download), or the release mixes GoReleaser outputs with manually added archives.

Common situations: A release where a legacy-named fallback archive was hand-uploaded after publishing; re-tagging a release so archive versions no longer match the manifest; mirroring that rewrites asset filenames.

Related errors

• checksum manifest %q not present in release
• read checksum manifest: %w
• empty expected checksum for %q
• checksum mismatch for %q: expected %s, got %s
• no matching release asset for %s/%s (tried: %s)

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/bd7484f600b929e6. Report an issue: GitHub.