siyuan-note/siyuan · error · errUpdatePackageUnavailable

update package is unavailable: [%s] checksum is unavailable

Error message

update package is unavailable: [%s] checksum is unavailable

What it means

Returned by getUpdatePkg() when the package entry exists and has download URLs, but pkg.Checksum is empty. Without a checksum the downloader cannot verify integrity, so the update is refused rather than risk installing a tampered or corrupt artifact. Wrapped form of errUpdatePackageUnavailable.

Source

Thrown at kernel/model/updater.go:128

	}

	if isVersionUpToDate(release.Version) {
		err = fmt.Errorf("version is up to date")
		return
	}

	pkgName := currentInstallPackageName(release.Version)
	if "" == pkgName {
		err = fmt.Errorf("%w for the current platform", errUpdatePackageUnavailable)
		return
	}
	pkg := release.Packages[pkgName]
	if nil == pkg || 0 == len(pkg.URLs) {
		err = fmt.Errorf("%w: [%s]", errUpdatePackageUnavailable, pkgName)
		return
	}
	if "" == pkg.Checksum {
		err = fmt.Errorf("%w: [%s] checksum is unavailable", errUpdatePackageUnavailable, pkgName)
		return
	}
	downloadPkgURLs = append(downloadPkgURLs, pkg.URLs...)
	checksum = pkg.Checksum
	return
}

func downloadInstallPkg(pkgURL, checksum string) (err error) {
	if "" == pkgURL || "" == checksum {
		err = errors.New("update package URL or checksum is empty")
		return
	}

	pkg := path.Base(pkgURL)
	savePath := filepath.Join(util.TempDir, "install", pkg)
	if gulu.File.IsExist(savePath) {
		localChecksum, _ := sha256Hash(savePath)
		if localChecksum == checksum {

View on GitHub (pinned to 251596fc0d)

Solutions

Retry shortly; the SHA256SUMS.txt asset may still be uploading.
Switch to the stable channel if on beta/alpha, or vice-versa, to use a different checksum source (cloud JSON vs GitHub manifest).
Check the GitHub release page directly to confirm SHA256SUMS.txt exists and lists your package; if not, report the release as incomplete.

Defensive patterns

Strategy: retry

Try / catch

// Distinguish checksum-missing from other unavailability; retry once after refresh.
_, _, err := getUpdatePkg()
if err != nil && strings.Contains(err.Error(), "checksum is unavailable") {
    getUpdateRelease(true) // force-refresh release metadata
    _, _, err = getUpdatePkg()
}

Prevention

Never bypass checksum verification by patching the guard — it exists to prevent tampered installs.
Retry after forcing a release refresh, since manifests propagate after assets.
Switch channels to change checksum source (cloud JSON vs GitHub manifest).

When it happens

Trigger: On the stable channel: getStablePackageChecksum returned "" because the cloud JSON's 'checksums' map omits the pkgName or the value fails normalizeSHA256 (wrong length / non-hex). On the GitHub channel: the asset's Digest field is empty AND getGitHubManifestChecksum failed (no SHA256SUMS.txt, manifest download error, digest mismatch, or pkgName not listed in the manifest).

Common situations: A release whose SHA256SUMS.txt manifest was not uploaded or was uploaded as a non-asset. GitHub asset digest fields absent for older releases. A mirror serving a manifest that doesn't yet list the newest package. Network failure fetching the manifest (see errors 953–959).

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/145f35ad3b098082. Report an issue: GitHub.