multica-ai/multica · error

download checksum manifest: %w

Error message

download checksum manifest: %w

What it means

Before downloading the archive, the updater fetches checksums.txt (the GoReleaser manifest asset) so half-published releases fail fast; a fetch failure is wrapped as 'download checksum manifest: %w'. The underlying error is usually the 'HTTP %d from %s' error from fetchURLBytes or a transport error (timeout, DNS).

Source

Thrown at server/internal/cli/update.go:404

	}
	asset, err := findReleaseAsset(release.Assets, tag, runtime.GOOS, runtime.GOARCH)
	if err != nil {
		return "", err
	}
	manifestAsset, err := findChecksumManifestAsset(release.Assets)
	if err != nil {
		return "", err
	}
	downloadURL := asset.BrowserDownloadURL
	assetName := asset.Name

	// Pull the checksum manifest first so a release that is half-published
	// (archives uploaded but checksums.txt not yet) fails before we eat the
	// archive's bandwidth.
	timeout := updateDownloadTimeoutOrDefault(downloadTimeout)
	manifestData, err := fetchURLBytes(manifestAsset.BrowserDownloadURL, timeout)
	if err != nil {
		return "", fmt.Errorf("download checksum manifest: %w", err)
	}
	expectedSum, err := parseChecksumManifest(manifestData, assetName)
	if err != nil {
		return "", fmt.Errorf("parse checksum manifest: %w", err)
	}

	// Buffer the archive into memory so we can verify the full SHA-256
	// before writing anything to disk. Release archives are ~10–30 MB; the
	// extraction code already buffers zip archives in full (random access
	// requirement), so this is not a new memory cost on Windows. For tar.gz
	// it adds a single in-RAM copy, which is preferable to running the
	// untrusted bytes through gzip+tar extraction before the SHA-256 check.
	archiveData, err := fetchURLBytes(downloadURL, timeout)
	if err != nil {
		return "", fmt.Errorf("download failed: %w", err)
	}

	if err := verifyAssetSHA256(archiveData, expectedSum, assetName); err != nil {

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Open the release page and confirm checksums.txt is listed; if missing, wait for the pipeline or re-run the release job.
2. Retry after a short delay — the poller's next tick re-attempts by design.
3. For HTTP status errors, apply the same diagnosis as fetchURLBytes (rate limit vs 404 vs 5xx).
4. Never skip the checksum step manually; a missing manifest is treated as a failed update on purpose.

Example fix

null

out, err := cli.UpdateViaDownload(ver)
if err != nil {
    if strings.HasPrefix(err.Error(), "download checksum manifest") {
        // half-published release or transient CDN error; retry next tick
        return scheduleRetry(err)
    }
}

When it happens

Trigger: The release exists but checksums.txt has not been uploaded yet (publish race); checksums.txt was deleted from the release; a CDN 5xx or timeout while fetching the small manifest; rate limiting on the asset download endpoint.

Common situations: Updating immediately after a release announcement while the GoReleaser pipeline is still running; releases whose assets were edited manually and the manifest was removed.

Related errors

• download failed: %w
• get attachment: %w
• download file: %w
• update failed: %w
• checksum manifest %q not present in release

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/d68967bd56839597. Report an issue: GitHub.