What causes "checksum manifest is unavailable" in siyuan-note/siyuan?

Retry after the release finishes processing; asset State transitions to 'uploaded' once ready.

checksum manifest is unavailable

Error message

checksum manifest is unavailable

What it means

Returned by getGitHubManifestChecksum(ctx, release, pkgName) when the release has no asset named exactly 'SHA256SUMS.txt', or that asset's State is not 'uploaded', or its BrowserDownloadURL is empty. The per-asset Digest was empty (otherwise the caller would have used it directly), so the manifest is the fallback checksum source — and it is missing.

Source

Thrown at kernel/model/updater_release.go:366

			return ""
		}
	}
	return ""
}

func findGitHubReleaseAsset(release *githubRelease, name string) *githubReleaseAsset {
	for _, asset := range release.Assets {
		if nil != asset && name == asset.Name {
			return asset
		}
	}
	return nil
}

func getGitHubManifestChecksum(ctx context.Context, release *githubRelease, pkgName string) (string, error) {
	manifestAsset := findGitHubReleaseAsset(release, "SHA256SUMS.txt")
	if nil == manifestAsset || "uploaded" != manifestAsset.State || "" == manifestAsset.BrowserDownloadURL {
		return "", errors.New("checksum manifest is unavailable")
	}
	manifestDigest := normalizeSHA256(manifestAsset.Digest)
	manifestCacheKey := ""
	if "" != manifestDigest {
		manifestCacheKey = manifestAsset.BrowserDownloadURL + "#" + manifestDigest
	}
	if "" != manifestCacheKey {
		cached, ok := githubManifestCache.Load(manifestCacheKey)
		if ok {
			if checksum := parseChecksumManifest(cached.(string), pkgName); "" != checksum {
				return checksum, nil
			}
			return "", errors.New("package checksum is unavailable")
		}
	}

	response, err := httpclient.NewCloudRequest30s().SetContext(ctx).Get(manifestAsset.BrowserDownloadURL)
	if err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

Retry after the release finishes processing; asset State transitions to 'uploaded' once ready.
Switch to the stable channel, whose checksums come from the cloud JSON rather than the GitHub manifest.
If the release is old and never had a manifest, that release simply cannot be auto-installed via the GitHub channel — update manually.

Defensive patterns

Strategy: fallback

Validate before calling

// Before relying on the manifest, check asset presence.
if asset := findGitHubReleaseAsset(release, "SHA256SUMS.txt"); asset == nil || asset.State != "uploaded" || asset.BrowserDownloadURL == "" {
    // no manifest; use stable-channel cloud JSON checksums instead
    return getStablePackageChecksum(rhyResult, pkgName)
}

Prevention

Treat a missing manifest as a soft condition — fall back to another checksum source.
Don't fail the whole update if only the manifest is missing; the asset Digest may still be usable.
Retry after the release finishes processing uploads.

When it happens

Trigger: A release published without a SHA256SUMS.txt asset. The asset exists but is still processing (State != 'uploaded'). The asset exists but GitHub hasn't populated BrowserDownloadURL yet. An older release predating the manifest convention.

Common situations: Release pipeline failed to attach the checksum manifest. Checking immediately after publish before GitHub finishes processing the asset upload. Older historical releases that predate the SHA256SUMS.txt convention.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/2dd48caf6e827b78. Report an issue: GitHub.