router-for-me/CLIProxyAPI · error

artifact checksum missing

Error message

artifact checksum missing

What it means

VerifyArtifactChecksum verifies downloaded bytes against artifact.SHA256. It throws 'artifact checksum missing' when the artifact entry in the install plan has no (or only whitespace) sha256 field. The check is a hard precondition: the library refuses to install content it cannot verify, rather than skipping verification.

Source

Thrown at internal/pluginstore/direct.go:48

	}
	maxSize := int64(0)
	if artifact.Size > 0 {
		maxSize = artifact.Size
	}
	data, errDownload := c.get(ctx, artifact.URL, "application/octet-stream", RequestKindArtifact, maxSize)
	if errDownload != nil {
		return nil, errDownload
	}
	if maxSize > 0 && int64(len(data)) > maxSize {
		return nil, fmt.Errorf("artifact exceeds declared size")
	}
	return data, nil
}

func VerifyArtifactChecksum(artifact Artifact, data []byte) error {
	expected := strings.ToLower(strings.TrimSpace(artifact.SHA256))
	if expected == "" {
		return fmt.Errorf("artifact checksum missing")
	}
	actualBytes := sha256.Sum256(data)
	actual := hex.EncodeToString(actualBytes[:])
	if actual != expected {
		return fmt.Errorf("artifact checksum mismatch")
	}
	return nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Add the correct sha256 hex digest for every artifact in the plugin manifest (sha256sum of each published binary).
2. If you build Artifact values in code, populate the SHA256 field from your release tooling.
3. If you maintain the store tooling, make manifest generation fail when sha256 is empty so this is caught at publish time.

Example fix

# before (manifest fragment)
artifacts:
  - goos: linux
    goarch: amd64
    url: https://example.com/p-linux-amd64
    # sha256 missing -> 'artifact checksum missing'

# after
artifacts:
  - goos: linux
    goarch: amd64
    url: https://example.com/p-linux-amd64
    size: 1350000
    sha256: "<sha256 of p-linux-amd64>"

if strings.TrimSpace(artifact.SHA256) == "" {
    return fmt.Errorf("artifact %s has no sha256 in the manifest — refusing unverified install", artifact.Name)
}

func artifactHasChecksum(a pluginstore.Artifact) bool {
    return strings.TrimSpace(a.SHA256) != ""
}

When it happens

Trigger: Calling VerifyArtifactChecksum(artifact, data) where strings.TrimSpace(artifact.SHA256) == "". Happens when the plugin manifest omits the sha256 field for an artifact, or when an Artifact struct is built by hand (e.g. wrapping a URL) without a digest.

Common situations: Hand-authored plugin manifests where the author skipped generating digests; manifest generators that forget the sha256 field for one platform; constructing Artifact literals in code.

Related errors

• line %d: invalid sha256 length
• checksum mismatch for %s
• artifact checksum mismatch
• plugin_manifest_failed
• plugin store auth missing header-name

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/c9af27a8ea54a0fa. Report an issue: GitHub.