No SHA256 hash found for {self._url}. Please update the hash

Error message

No SHA256 hash found for {self._url}. Please update the hash database by running 'scripts/update_downloaded_dependency_hashes.py'.

What it means

download_to verifies downloaded dependency artifacts against a local SHA256 hash database. In CI, when the URL has no recorded hash, it raises RuntimeError demanding the hash database be regenerated; locally it only logs a warning and downloads unverified.

Source

Thrown at src/solidlsp/dependency_provider.py:360

        self._verified = verified

    def get_url(self) -> str:
        return self._url

    def download_to(self, target_path: str | PathLike) -> None:
        """
        Downloads the dependency to the specified target path.
        If defined at construction, will apply hash verification and archive extraction.

        :param target_path: the path to which the dependency should be downloaded (or extracted if applicable)
        """
        if not isinstance(target_path, str):
            target_path = str(target_path)
        if self._verified:
            sha256 = DownloadedDependencyHashDatabase.get_instance().get_sha256(self)
            if sha256 is None:
                if is_running_in_ci():
                    raise RuntimeError(
                        f"No SHA256 hash found for {self._url}. "
                        "Please update the hash database by running 'scripts/update_downloaded_dependency_hashes.py'."
                    )
                log.warning("No SHA256 hash found for %s. The downloaded file will not be verified.", self._url)
        else:
            sha256 = None
        FileUtils.download_and_extract_archive_verified(
            self._url, target_path, archive_type=self._archive_type, expected_sha256=sha256, allowed_hosts=self._allowed_hosts
        )

View on GitHub (pinned to 7fcbca7e62)

Solutions

Run `python scripts/update_downloaded_dependency_hashes.py` to add the new artifact hash, then retry.
If a custom version is intentional and local, unset CI markers or accept unverified download locally (warning only).
Report/pin back to a version whose artifact is present in the hash database.

Example fix

// before
ci_job:
  run: pytest test_dependencies.py
// after
ci_job:
  pre: python scripts/update_downloaded_dependency_hashes.py
  run: pytest test_dependencies.py

Defensive patterns

Strategy: validation

Validate before calling

from solidlsp.dependency_provider import DownloadedDependencyHashDatabase

def ensure_hash_known(download) -> bool:
    if not download.is_verified:
        return True
    return DownloadedDependencyHashDatabase.get_instance().get_sha256(download) is not None

Type guard

def has_recorded_hash(download) -> bool:
    return isinstance(download.url, str) and DownloadedDependencyHashDatabase.get_instance().get_sha256(download) is not None

Try / catch

try:
    dep.download_to(target)
except RuntimeError as e:
    if 'No SHA256 hash found' in str(e):
        subprocess.run(['python', 'scripts/update_downloaded_dependency_hashes.py'], check=True)
        dep.download_to(target)
    else:
        raise

Prevention

Run scripts/update_downloaded_dependency_hashes.py as a CI pre-step whenever dependency versions are bumped.
Commit the updated hash database together with version-pinning changes.
Prefer versions whose artifact URLs already exist in the hash database.

When it happens

Trigger: Calling download_to (via _setup_runtime_dependencies or _get_or_install_core_dependency) for a dependency whose URL is missing from the hash DB while is_running_in_ci() is true — typically a newly pinned/custom version or updated release URL.

Common situations: Pinning a new language-server version whose artifact URL changed; JetBrains/language-vendor release updates; running tests in CI with a custom version setting.

Related errors

AI-assisted analysis of oraios/serena@7fcbca7e62 (2026-08-29). Data as JSON: /api/errors/0765f6a57d7cf778. Report an issue: GitHub.