xpzouying/xiaohongshu-mcp · error

SHA256SUMS 中未找到 %s

Error message

SHA256SUMS 中未找到 %s

What it means

fetchExpectedSHA scans every line of the downloaded SHA256SUMS file looking for an entry whose second whitespace-separated field equals the asset filename. This error is thrown when the file was fetched successfully but no line matches the expected asset name.

Source

Thrown at browser/browser_download.go:167

func fetchExpectedSHA(asset string) (string, error) {
	resp, err := (&http.Client{Timeout: 30 * time.Second}).Get(browserURL("SHA256SUMS"))
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("获取 SHA256SUMS: HTTP %d", resp.StatusCode)
	}
	sc := bufio.NewScanner(resp.Body)
	for sc.Scan() {
		// 格式：<hash>␠␠<filename>
		fields := strings.Fields(sc.Text())
		if len(fields) == 2 && fields[1] == asset {
			return fields[0], nil
		}
	}
	return "", fmt.Errorf("SHA256SUMS 中未找到 %s", asset)
}

func findBinary(dir, binName string) string {
	var found string
	_ = filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
		if err != nil || info.IsDir() {
			return nil
		}
		if filepath.Base(path) == binName {
			found = path
			return io.EOF // 提前结束
		}
		return nil
	})
	if found != "" {
		if err := os.Chmod(found, 0o755); err != nil {
			logrus.Debugf("chmod %s: %v", found, err)
		}

View on GitHub (pinned to 332d196854)

Solutions

1. Download SHA256SUMS manually and grep for the asset name to confirm what the manifest actually contains
2. Compare the local asset filename with upstream's current release assets and update the expected name/version
3. Verify the manifest corresponds to the same release/version as the downloaded archive
4. Validate the response body looks like a checksum file (two-column lines) rather than an HTML error page returned with 200
5. Update the library if upstream changed the manifest format

Example fix

// before
return "", fmt.Errorf("SHA256SUMS 中未找到 %s", asset)
// after — add context including the manifest source
return "", fmt.Errorf("SHA256SUMS 中未找到 %s (manifest: %s)", asset, browserURL("SHA256SUMS"))

body, _ := http.Get(browserURL("SHA256SUMS"))
// 手动确认清单中包含资产名后再调用
// grep "<asset>" SHA256SUMS

expected, err := fetchExpectedSHA(asset)
if err != nil {
	if strings.Contains(err.Error(), "未找到") {
		// 清单与资产不匹配：刷新版本或跳过校验并告警
		return verifyByRedownload(asset)
	}
	return err
}

When it happens

Trigger: verifySHA256 calls fetchExpectedSHA with an asset filename (the browser archive basename) and strings.Fields over each SHA256SUMS line never yields len(fields)==2 with fields[1] == asset — the asset name is absent or the line format differs.

Common situations: Upstream renamed the archive (e.g. version/platform naming change) so the local asset name no longer appears in the manifest; the SHA256SUMS file uses a different delimiter or includes extra columns; the manifest belongs to a different release than the downloaded file; a proxy returned an HTML error page with status 200.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• 校验失败: %w
• %s SHA256 不匹配：期望 %s，实际 %s
• 获取 SHA256SUMS: HTTP %d
• invalid image URL format
• downloaded file is not a valid image

AI-assisted analysis of xpzouying/xiaohongshu-mcp@332d196854 (2026-09-05). Data as JSON: /api/errors/632c622a214ebfb7. Report an issue: GitHub.