oraios/serena · error · RuntimeError

No SHA256 checksum configured for Taplo archive: {archive_fi

Error message

No SHA256 checksum configured for Taplo archive: {archive_filename}

What it means

_download_taplo refuses to download a Taplo archive when no SHA256 checksum is configured for the resolved version/archive filename pair, unless the version is not one of the pinned ones. This library enforces checksum-verified downloads to guarantee supply-chain integrity; an unknown version without a pinned hash means it cannot verify the archive, so it raises RuntimeError instead of downloading blindly.

Source

Thrown at src/solidlsp/language_servers/taplo_server.py:184

                raise FileNotFoundError(
                    f"Taplo executable not found at {taplo_executable}. "
                    "Installation may have failed. Try installing manually: cargo install taplo-cli --locked"
                )

            return taplo_executable

        def _create_launch_command(self, core_path: str) -> list[str]:
            return [core_path, "lsp", "stdio"]

        @classmethod
        def _download_taplo(cls, install_dir: str, executable_path: str, version: str = DEFAULT_TAPLO_VERSION) -> None:
            """Download and extract Taplo binary using the shared verified download helper."""
            download_url, _ = _get_taplo_download_url(version)
            archive_filename = os.path.basename(download_url)
            # only verify the SHA when the resolved version is one of our pinned ones (INITIAL or current DEFAULT)
            expected_hash = _taplo_sha(version, archive_filename)
            if expected_hash is None and version in (INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION):
                raise RuntimeError(f"No SHA256 checksum configured for Taplo archive: {archive_filename}")

            try:
                log.info(f"Downloading Taplo from: {download_url}")
                archive_type = "zip" if archive_filename.endswith(".zip") else "gz"
                target_path = install_dir if archive_type == "zip" else executable_path
                FileUtils.download_and_extract_archive_verified(
                    download_url,
                    target_path,
                    archive_type,
                    expected_sha256=expected_hash,
                    allowed_hosts=TAPLO_ALLOWED_HOSTS,
                )

                # Make executable on Unix systems
                if os.name != "nt":
                    os.chmod(executable_path, os.stat(executable_path).st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)

                log.info(f"Taplo installed successfully at: {executable_path}")

View on GitHub (pinned to 7fcbca7e62)

Solutions

1. Add the SHA256 entry for the new version's archive filename to the checksum table used by _taplo_sha (compute via `sha256sum <archive>`).
2. Pin back to a supported version (INITIAL or DEFAULT) that already has a configured checksum.
3. Install Taplo manually (`cargo install taplo-cli --locked`) so the download path is never taken.

Example fix

// before
default_taplo_version = "0.19.3"  # bumped, but no SHA registered
// after
default_taplo_version = "0.19.3"
# add to checksum table:
# "taplo-0.19.3-x86_64-unknown-linux-musl.tar.gz": "<sha256...>"

from solidlsp.language_servers.taplo_server import _taplo_sha, INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION
version = "<configured taplo version>"
archive = f"taplo-{version}-x86_64-unknown-linux-musl.tar.gz"
if _taplo_sha(version, archive) is None:
    raise ValueError(f"No SHA256 configured for {archive}; pin a known version or add its checksum")

try:
    server = SolidLanguageServer.create("taplo")
except RuntimeError as e:
    if "No SHA256 checksum" in str(e):
        # fall back to pinned version or manual install
        os.environ["SOLIDLSP_TAPLO_VERSION"] = DEFAULT_TAPLO_VERSION
        server = SolidLanguageServer.create("taplo")
    else:
        raise

When it happens

Trigger: Calling _get_or_install_core_dependency on Taplo when `taplo` is absent from PATH and the configured Taplo version resolves to a version whose archive filename has no entry in the SHA256 table (e.g. a custom DEFAULT_TAPLO_VERSION bump without adding the new hash, while version is still INITIAL or DEFAULT so the guard applies).

Common situations: Upgrading DEFAULT_TAPLO_VERSION in code without adding the new archive's SHA256; overriding the Taplo version via settings to an unpinned release; a new Taplo release changing archive naming so _taplo_sha misses the lookup.

Related errors

• SHA256 checksum mismatch for vshaxe VSIX. Expected {expected
• No SHA256 hash found for {self._url}. Please update the hash
• Unsupported phpantom_version '{version}'. Known bundled vers
• Taplo executable not found at {taplo_executable}. Installati
• Failed to download Taplo from {download_url}. Try installing

AI-assisted analysis of oraios/serena@7fcbca7e62 (2026-08-29). Data as JSON: /api/errors/d55e3d6ec6f4a21a. Report an issue: GitHub.