router-for-me/CLIProxyAPI · error

checksum for %s not found

Error message

checksum for %s not found

What it means

VerifyChecksum was asked to verify a named artifact, but the parsed checksums map has no entry for that name — the expected value is empty. This fails closed: without a known-good digest the store refuses to trust the artifact. The name lookup is exact, so path/matching issues are the most common cause rather than a genuinely missing entry.

Source

Thrown at internal/pluginstore/checksum.go:37

			return nil, fmt.Errorf("line %d: invalid checksum entry", lineNumber+1)
		}
		hash := strings.ToLower(strings.TrimSpace(fields[0]))
		if len(hash) != sha256.Size*2 {
			return nil, fmt.Errorf("line %d: invalid sha256 length", lineNumber+1)
		}
		if _, errDecode := hex.DecodeString(hash); errDecode != nil {
			return nil, fmt.Errorf("line %d: invalid sha256: %w", lineNumber+1, errDecode)
		}
		name := strings.TrimPrefix(strings.TrimSpace(fields[1]), "*")
		out[name] = hash
	}
	return out, nil
}

func VerifyChecksum(name string, data []byte, checksums map[string]string) error {
	expected := strings.ToLower(strings.TrimSpace(checksums[name]))
	if expected == "" {
		return fmt.Errorf("checksum for %s not found", name)
	}
	actualBytes := sha256.Sum256(data)
	actual := hex.EncodeToString(actualBytes[:])
	if actual != expected {
		return fmt.Errorf("checksum mismatch for %s", name)
	}
	return nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Align names: regenerate checksums from the same directory/prefix the verifier uses, or pass the exact key from the file (leading '*' is already trimmed)
2. Confirm the checksums file shipped with this store version actually lists the artifact you are downloading
3. If publishing a store, generate checksums with relative paths matching the registry's artifact names

Example fix

# before (checksums.txt)
e3b0c44...855  dist/plugin.wasm
# verify called with "plugin.wasm" -> not found

# after (checksums.txt)
e3b0c44...855  plugin.wasm
# verify called with "plugin.wasm" -> ok

checklist, err := ParseChecksums(checksumFile)
if err != nil { return err }
if _, ok := checklist[artifactName]; !ok {
    return fmt.Errorf("checksums file lacks entry for %q; available: %v", artifactName, keys(checklist))
}

When it happens

Trigger: Verifying 'plugin.wasm' when the checksums file lists it as 'dist/plugin.wasm' or './plugin.wasm' (or with a Windows path), so map keys and the requested name disagree.

Common situations: Checksums generated from a different working directory than the verifier uses; artifact renamed between store index and checksums publication; checksums file for an older release that predates the artifact.

Related errors

• line %d: invalid checksum entry
• checksum mismatch for %s
• artifact checksum mismatch
• line %d: invalid sha256 length
• line %d: invalid sha256: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/aeb51eb4f88b7b76. Report an issue: GitHub.