pnpm/pnpm · error · PnpmError

NODE_INTEGRITY_HASH_NOT_FOUND

NODE_INTEGRITY_HASH_NOT_FOUND

Error message

SHA-256 hash not found in SHASUMS256.txt for: ${fileName}

What it means

pickFileChecksumFromShasumsFile() scans SHASUMS256.txt lines for one whose trimmed form ends with exactly two spaces plus the file name, then extracts the SHA-256. If no line matches the requested artifact, NODE_INTEGRITY_HASH_NOT_FOUND is thrown: the checksum file does not describe that file name.

Source

Thrown at pnpm11/crypto/shasums-file/src/index.ts:139

): Promise<string> {
  const res = await fetch(shasumsUrl)
  if (!res.ok) {
    throw new PnpmError(
      'FAILED_DOWNLOAD_SHASUM_FILE',
      `Failed to fetch integrity file: ${shasumsUrl} (status: ${res.status})`
    )
  }
  const body = await res.text()
  return body
}

const SHA256_REGEX = /^[a-f0-9]{64}$/

export function pickFileChecksumFromShasumsFile (body: string, fileName: string): string {
  const line = body.split('\n').find(line => line.trim().endsWith(`  ${fileName}`))

  if (!line) {
    throw new PnpmError(
      'NODE_INTEGRITY_HASH_NOT_FOUND',
      `SHA-256 hash not found in SHASUMS256.txt for: ${fileName}`
    )
  }

  const [sha256] = line.trim().split(/\s+/)
  if (!SHA256_REGEX.test(sha256)) {
    throw new PnpmError(
      'NODE_MALFORMED_INTEGRITY_HASH',
      `Malformed SHA-256 for ${fileName}: ${sha256}`
    )
  }

  const buffer = Buffer.from(sha256, 'hex')
  const base64 = buffer.toString('base64')
  return `sha256-${base64}`
}

View on GitHub (pinned to 5b11d3a15b)

Solutions

1. Fetch the SHASUMS256.txt for that version and compare your exact file name against its lines
2. Fix the platform/arch mapping used to build the file name (match nodejs.org's official artifact naming)
3. Ensure the shasums URL and the artifact URL derive from the same version directory
4. Switch node-mirror to the official nodejs.org tree if a mirror mangles the file

Example fix

// before
const checksum = pickFileChecksumFromShasumsFile(body, `node-v${version}-${platform}-${arch}.tar.xz`)

// after
const fileName = buildOfficialNodeArtifactName(version, platform, arch) // e.g. maps win32 -> win-x64
const checksum = pickFileChecksumFromShasumsFile(body, fileName)

const SHA_LINE = (fileName: string): RegExp => new RegExp(`\\s${escapeRegExp(fileName)}$`)

function shasumsHasEntry (body: string, fileName: string): boolean {
  return body.split('\n').some(line => line.trim().endsWith(`  ${fileName}`))
}

if (!shasumsHasEntry(body, fileName)) {
  throw new Error(`${fileName} is not listed in SHASUMS256.txt — check platform/version before extracting a checksum`)
}

try {
  const integrity = pickFileChecksumFromShasumsFile(body, fileName)
} catch (err) {
  if ((err as PnpmError).code === 'NODE_INTEGRITY_HASH_NOT_FOUND') {
    // surface the exact artifact name and the shasums source for diagnosis
    throw new Error(`no checksum for artifact ${fileName}; verify it exists for this Node version/mirror`)
  }
  throw err
}

When it happens

Trigger: Looking up 'node-v20.11.0-linux-armv7l.tar.xz' when that version ships no such artifact; a file name built with the wrong platform/arch token; the shasums body fetched from a different version URL than the artifact; a mirror serving a truncated or rewritten SHASUMS256.txt.

Common situations: Unsupported platform/arch combinations for the requested Node version (e.g. armv6l/no 32-bit builds on newer releases); bugs in caller-side artifact naming; version mismatch between mirror directories.

Related errors

• NODE_MALFORMED_INTEGRITY_HASH
• DENO_PARSE_HASH
• LOGIN_MISSING_CREDENTIALS
• APPROVE_BUILDS_ALL_WITH_ARGS
• CONFIG_SET_AUTH_NON_STRING

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/4f8906c45e23d9b1. Report an issue: GitHub.