tonhowtf/omniget · error

veio sem digest da API do GitHub; download descartado

Error message

{} veio sem digest da API do GitHub; download descartado

What it means

GitHub's API publishes a sha256 `digest` for every release asset. `download_verified` refuses to keep a downloaded binary if the digest is absent from the API response — a deliberate fail-closed policy since the bytes will be executed later. This protects against tampered or malformed API responses.

Solutions

  1. Inspect the raw API JSON for the asset and confirm a `sha256-...` digest field exists
  2. Remove/adjust proxies or mirrors that strip fields, or query api.github.com directly
  3. Update to a version where `parse_github_digest` handles the current digest format
  4. If unavoidable (e.g. GHE without digests), provide a verified checksum out-of-band — do not bypass the check

Example fix

// before
let digest = asset.digest.as_deref().ok_or_else(|| anyhow!("... sem digest ..."))?;
// after
let digest = match asset.digest.as_deref() {
    Some(d) => d,
    None => fetch_digest_from_checksums_file(&client, &asset).await? // out-of-band verified source
};
Defensive patterns

Strategy: validation

Validate before calling

let json: serde_json::Value = client.get(asset_api_url).send().await?.json().await?;
if json["digest"].as_str().is_none() {
    eprintln!("API response missing digest — resolve proxy/GHE issue before downloading");
}

Try / catch

match download_verified(&client, &asset).await {
    Err(e) if e.to_string().contains("sem digest") => {
        // do NOT bypass; obtain checksum from a second trusted source or abort
        obtain_checksum_out_of_band(&asset).map(|d| verify_and_use(bytes, d))
    }
    other => other,
}

Prevention

When it happens

Trigger: `download_verified` receiving a `ReleaseAsset` whose `digest` field is None — GitHub omitted the `digest` field (older API behavior, proxies stripping it, or code that failed to parse it via `integrity::parse_github_digest`).

Common situations: Corporate proxy or mirror stripping JSON fields; GitHub temporarily omitting digests in an API change; a custom GitHub Enterprise server without digest support; parsing bug for the digest format.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of tonhowtf/omniget@8600b91f42 (2026-09-12). Data as JSON: /api/errors/7af53b0aeb7434e0. Report an issue: GitHub.

Appendix: source

Thrown at src-tauri/omniget-core/src/core/spicetify.rs:432

}

async fn download_verified(
    client: &reqwest::Client,
    asset: &ReleaseAsset,
) -> anyhow::Result<Vec<u8>> {
    let response = client.get(&asset.url).send().await?;
    if !response.status().is_success() {
        return Err(anyhow!(
            "download de {} falhou: HTTP {}",
            asset.name,
            response.status()
        ));
    }
    let bytes = response.bytes().await?.to_vec();
    // O GitHub publica o digest de todo asset; sem ele algo está errado na
    // resposta, e o binário vai ser executado. Fail-closed.
    let expected = asset.digest.as_deref().ok_or_else(|| {
        anyhow!(
            "{} veio sem digest da API do GitHub; download descartado",
            asset.name
        )
    })?;
    integrity::verify_sha256(&bytes, expected, &asset.name)?;
    Ok(bytes)
}

/// Sufixo do asset do CLI para este sistema. Linux só tem amd64 no release.
fn cli_asset_suffix() -> anyhow::Result<&'static str> {
    Ok(if cfg!(target_os = "windows") {
        if cfg!(target_arch = "aarch64") {
            "windows-arm64.zip"
        } else if cfg!(target_pointer_width = "32") {
            "windows-x32.zip"
        } else {
            "windows-x64.zip"
        }

View on GitHub (pinned to 8600b91f42)