What causes "{} veio sem digest da API do GitHub; download descartado" in tonhowtf/omniget?

Re-fetch the asset info from the live GitHub API so the 'digest' field is populated

veio sem digest da API do GitHub; download descartado

Error message

{} veio sem digest da API do GitHub; download descartado

What it means

github::download() verifies integrity using the digest returned by the GitHub API. If the asset carries no digest (None) the function refuses to return unverified bytes and errors instead — except in the branch above where a warning permits accepting without verification; this hard-fail branch is for when no digest is available at all and verification is mandatory.

Solutions

Re-fetch the asset info from the live GitHub API so the 'digest' field is populated
If verification is intentionally not required, use the path that warns and accepts (the warn branch) rather than the strict one
Upgrade/refresh any cached release JSON used to build ReleaseAsset

Example fix

// before
let a = ReleaseAsset { name: name.into(), tag: tag.clone(), digest: None };
download(&a).await?;
// after
let a = fetch_asset_from_api("owner/repo", Some("v1.2.0"), name).await?; // digest populated
download(&a).await?;

Defensive patterns

Strategy: validation

Validate before calling

if asset.digest.is_none() {
    return Err(format!("asset {} sem digest; busque os metadados novamente da API do GitHub", asset.name));
}
let bytes = github::download(&asset).await?;

Type guard

fn has_digest(a: &ReleaseAsset) -> bool {
    a.digest.is_some()
}

Prevention

Always build ReleaseAsset from fresh API responses, never hand-assemble
Re-fetch release metadata if it came from a cache older than the digest field's introduction
Treat missing digest as a signal to refetch rather than to disable verification

When it happens

Trigger: Calling download() with a ReleaseAsset whose digest field is None because the GitHub API response lacked 'digest' for that asset — older API payloads, cached/proxied responses, or an asset constructed manually without a digest.

Common situations: Older GitHub API responses predating the digest field; manually assembled ReleaseAsset structs in tests/tools; third-party mirrors or API caches stripping the field.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of tonhowtf/omniget@8600b91f42 (2026-09-12). Data as JSON: /api/errors/54720704239a04de. Report an issue: GitHub.

Appendix: source

Thrown at src-tauri/omniget-core/src/core/tools/github.rs:104

    asset: &ReleaseAsset,
    allow_unverified: bool,
    progress: &super::ProgressFn,
    id: &str,
) -> anyhow::Result<Vec<u8>> {
    let tmp = super::temp_dir().join(format!("{}.download", asset.name));
    super::download_to(client, &asset.url, &tmp, progress, id).await?;
    let bytes = tokio::fs::read(&tmp).await?;
    let _ = tokio::fs::remove_file(&tmp).await;
    match asset.digest.as_deref() {
        Some(expected) => integrity::verify_sha256(&bytes, expected, &asset.name)?,
        None if allow_unverified => {
            tracing::warn!(
                "[tools] {} veio sem digest; aceito sem verificacao",
                asset.name
            )
        }
        None => {
            return Err(anyhow!(
                "{} veio sem digest da API do GitHub; download descartado",
                asset.name
            ))
        }
    }
    Ok(bytes)
}

pub fn unpack(data: &[u8], name: &str, dest: &Path) -> anyhow::Result<()> {
    std::fs::create_dir_all(dest)?;
    if name.ends_with(".zip") {
        let mut archive = zip::ZipArchive::new(std::io::Cursor::new(data))
            .map_err(|e| anyhow!("zip invalido: {}", e))?;
        for i in 0..archive.len() {
            let mut file = archive.by_index(i)?;
            let Some(rel) = file.enclosed_name() else {
                continue;
            };

View on GitHub (pinned to 8600b91f42)