router-for-me/CLIProxyAPI · error

line %d: invalid sha256 length

Error message

line %d: invalid sha256 length

What it means

A checksums-file line parsed into fields, but the first field (the hash) is not exactly 64 hex characters (sha256.Size*2). ParseChecksums only accepts SHA-256 digests; a 40-char SHA-1, 128-char SHA-512, or truncated hash on the reported line triggers this error.

Source

Thrown at internal/pluginstore/checksum.go:23

	"encoding/hex"
	"fmt"
	"strings"
)

func ParseChecksums(data []byte) (map[string]string, error) {
	out := map[string]string{}
	for lineNumber, rawLine := range strings.Split(string(data), "\n") {
		line := strings.TrimSpace(rawLine)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		fields := strings.Fields(line)
		if len(fields) < 2 {
			return nil, fmt.Errorf("line %d: invalid checksum entry", lineNumber+1)
		}
		hash := strings.ToLower(strings.TrimSpace(fields[0]))
		if len(hash) != sha256.Size*2 {
			return nil, fmt.Errorf("line %d: invalid sha256 length", lineNumber+1)
		}
		if _, errDecode := hex.DecodeString(hash); errDecode != nil {
			return nil, fmt.Errorf("line %d: invalid sha256: %w", lineNumber+1, errDecode)
		}
		name := strings.TrimPrefix(strings.TrimSpace(fields[1]), "*")
		out[name] = hash
	}
	return out, nil
}

func VerifyChecksum(name string, data []byte, checksums map[string]string) error {
	expected := strings.ToLower(strings.TrimSpace(checksums[name]))
	if expected == "" {
		return fmt.Errorf("checksum for %s not found", name)
	}
	actualBytes := sha256.Sum256(data)
	actual := hex.EncodeToString(actualBytes[:])
	if actual != expected {

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Regenerate the file with sha256sum (or sha256sum -b for binary mode)
2. Fix or remove the specific malformed line indicated by the line number
3. Ensure no other digest algorithms are mixed into the same file

Example fix

# before
da39a3ee5e6b4b0d3255bfef95601890afd80709  plugin.wasm  # sha1, 40 chars

# after
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  plugin.wasm

func allHashesAreSha256(data []byte) error {
    for i, raw := range strings.Split(string(data), "\n") {
        line := strings.TrimSpace(raw)
        if line == "" || strings.HasPrefix(line, "#") { continue }
        h := strings.ToLower(strings.Fields(line)[0])
        if len(h) != 64 {
            return fmt.Errorf("line %d uses a non-sha256 digest", i+1)
        }
    }
    return nil
}

When it happens

Trigger: The checksums file was generated with sha1sum/shasum -a 1 or md5sum instead of sha256sum, or a hash was copy-truncated, on the line named in the error.

Common situations: Store tooling defaults to SHA-1 on older distros; developer used 'shasum' without -a 256; manual paste dropped characters; mixed-format file where some lines are SHA-1.

Related errors

• line %d: invalid checksum entry
• checksum mismatch for %s
• artifact checksum missing
• artifact checksum mismatch
• line %d: invalid sha256: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/5d840910c4ab0d34. Report an issue: GitHub.