oraios/serena · error · RuntimeError

No SHA256 checksum configured for Taplo archive

Error message

No SHA256 checksum configured for Taplo archive: {archive_filename}

What it means

_download_taplo refuses to download a Taplo archive when no SHA256 checksum is configured for the resolved version/archive filename pair, unless the version is not one of the pinned ones. This library enforces checksum-verified downloads to guarantee supply-chain integrity; an unknown version without a pinned hash means it cannot verify the archive, so it raises RuntimeError instead of downloading blindly.

Solutions

1. Add the SHA256 entry for the new version's archive filename to the checksum table used by _taplo_sha (compute via `sha256sum <archive>`).
2. Pin back to a supported version (INITIAL or DEFAULT) that already has a configured checksum.
3. Install Taplo manually (`cargo install taplo-cli --locked`) so the download path is never taken.

Example fix

// before
default_taplo_version = "0.19.3"  # bumped, but no SHA registered
// after
default_taplo_version = "0.19.3"
# add to checksum table:
# "taplo-0.19.3-x86_64-unknown-linux-musl.tar.gz": "<sha256...>"

from solidlsp.language_servers.taplo_server import _taplo_sha, INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION
version = "<configured taplo version>"
archive = f"taplo-{version}-x86_64-unknown-linux-musl.tar.gz"
if _taplo_sha(version, archive) is None:
    raise ValueError(f"No SHA256 configured for {archive}; pin a known version or add its checksum")

try:
    server = SolidLanguageServer.create("taplo")
except RuntimeError as e:
    if "No SHA256 checksum" in str(e):
        # fall back to pinned version or manual install
        os.environ["SOLIDLSP_TAPLO_VERSION"] = DEFAULT_TAPLO_VERSION
        server = SolidLanguageServer.create("taplo")
    else:
        raise

When it happens

Trigger: Calling _get_or_install_core_dependency on Taplo when `taplo` is absent from PATH and the configured Taplo version resolves to a version whose archive filename has no entry in the SHA256 table (e.g. a custom DEFAULT_TAPLO_VERSION bump without adding the new hash, while version is still INITIAL or DEFAULT so the guard applies).

Common situations: Upgrading DEFAULT_TAPLO_VERSION in code without adding the new archive's SHA256; overriding the Taplo version via settings to an unpinned release; a new Taplo release changing archive naming so _taplo_sha misses the lookup.

Related errors

• SHA256 checksum mismatch for vshaxe VSIX. Expected
• Checksum verification failed for
• Failed to download Taplo from
• No SHA256 hash found for
• Taplo executable not found at

AI-assisted analysis of oraios/serena@7fcbca7e62 (2026-08-29). Data as JSON: /api/errors/d55e3d6ec6f4a21a. Report an issue: GitHub.

Appendix: source

Thrown at src/solidlsp/language_servers/taplo_server.py:184

                raise FileNotFoundError(
                    f"Taplo executable not found at {taplo_executable}. "
                    "Installation may have failed. Try installing manually: cargo install taplo-cli --locked"
                )

            return taplo_executable

        def _create_launch_command(self, core_path: str) -> list[str]:
            return [core_path, "lsp", "stdio"]

        @classmethod
        def _download_taplo(cls, install_dir: str, executable_path: str, version: str = DEFAULT_TAPLO_VERSION) -> None:
            """Download and extract Taplo binary using the shared verified download helper."""
            download_url, _ = _get_taplo_download_url(version)
            archive_filename = os.path.basename(download_url)
            # only verify the SHA when the resolved version is one of our pinned ones (INITIAL or current DEFAULT)
            expected_hash = _taplo_sha(version, archive_filename)
            if expected_hash is None and version in (INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION):
                raise RuntimeError(f"No SHA256 checksum configured for Taplo archive: {archive_filename}")

            try:
                log.info(f"Downloading Taplo from: {download_url}")
                archive_type = "zip" if archive_filename.endswith(".zip") else "gz"
                target_path = install_dir if archive_type == "zip" else executable_path
                FileUtils.download_and_extract_archive_verified(
                    download_url,
                    target_path,
                    archive_type,
                    expected_sha256=expected_hash,
                    allowed_hosts=TAPLO_ALLOWED_HOSTS,
                )

                # Make executable on Unix systems
                if os.name != "nt":
                    os.chmod(executable_path, os.stat(executable_path).st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)

                log.info(f"Taplo installed successfully at: {executable_path}")

View on GitHub (pinned to 7fcbca7e62)