siyuan-note/siyuan · error

update package URL or checksum is empty

Error message

update package URL or checksum is empty

What it means

Returned by downloadInstallPkg(pkgURL, checksum) at its entry guard when either pkgURL or checksum is an empty string. This is a defensive precondition check: the function refuses to start a download or trust a checksum-less file. In normal flow getUpdatePkg() guarantees both are non-empty before calling, so hitting this indicates a programming error in the caller.

Source

Thrown at kernel/model/updater.go:138

		return
	}
	pkg := release.Packages[pkgName]
	if nil == pkg || 0 == len(pkg.URLs) {
		err = fmt.Errorf("%w: [%s]", errUpdatePackageUnavailable, pkgName)
		return
	}
	if "" == pkg.Checksum {
		err = fmt.Errorf("%w: [%s] checksum is unavailable", errUpdatePackageUnavailable, pkgName)
		return
	}
	downloadPkgURLs = append(downloadPkgURLs, pkg.URLs...)
	checksum = pkg.Checksum
	return
}

func downloadInstallPkg(pkgURL, checksum string) (err error) {
	if "" == pkgURL || "" == checksum {
		err = errors.New("update package URL or checksum is empty")
		return
	}

	pkg := path.Base(pkgURL)
	savePath := filepath.Join(util.TempDir, "install", pkg)
	if gulu.File.IsExist(savePath) {
		localChecksum, _ := sha256Hash(savePath)
		if localChecksum == checksum {
			return
		}
	}

	err = os.MkdirAll(filepath.Join(util.TempDir, "install"), 0755)
	if err != nil {
		logging.LogErrorf("create temp install dir failed: %s", err)
		return
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Ensure the caller validates both arguments are non-empty before invoking downloadInstallPkg.
2. Route package selection through getUpdatePkg(), which already enforces non-empty URLs and checksum.
3. Add a unit test asserting the precondition on any new call site.

Example fix

// before
downloadInstallPkg(pkgURL, "") // panics-free but returns error, download never starts

// after
if "" == pkgURL || "" == checksum {
    return fmt.Errorf("%w: url=%q checksum-set=%v", errUpdatePackageUnavailable, pkgURL, checksum != "")
}
downloadInstallPkg(pkgURL, checksum)

// Pre-validate before calling the downloader.
if "" == pkgURL || "" == checksum {
    return fmt.Errorf("cannot download: pkgURL or checksum empty")
}
return downloadInstallPkg(pkgURL, checksum)

When it happens

Trigger: A caller bypasses getUpdatePkg() and invokes downloadInstallPkg("", checksum) or downloadInstallPkg(url, ""). A refactor leaves a code path that passes unset/zero-value strings. The single internal call site (checkDownloadInstallPkg line 93) passes values sourced from getUpdatePkg, which already validated non-empties, so production hits are rare.

Common situations: Plugin or fork code that calls the downloader directly without re-validating. A code change that introduces a new call site but forgets to populate the URL or checksum.

Related errors

• update channel is invalid
• verify checksum failed, download install package [%s] checks
• update channel is invalid
• Failed to update agent session permission
• Agent capability name and description are required

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/a714188cf71665f2. Report an issue: GitHub.