{"id":"7b1672409e5a1ed1","repo":"gohugoio/hugo","slug":"unsupported-hash-algorithm-q-use-either-md5-sh","errorCode":null,"errorMessage":"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512","messagePattern":"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"resources/resource_transformers/integrity/integrity.go","lineNumber":94,"sourceCode":"\t}\n\n\tctx.Data[\"Integrity\"] = integrity(t.algo, d)\n\tctx.AddOutPathIdentifier(\".\" + hex.EncodeToString(d[:]))\n\treturn nil\n}\n\nfunc newHash(algo string) (hash.Hash, error) {\n\tswitch algo {\n\tcase \"md5\":\n\t\treturn md5.New(), nil\n\tcase \"sha256\":\n\t\treturn sha256.New(), nil\n\tcase \"sha384\":\n\t\treturn sha512.New384(), nil\n\tcase \"sha512\":\n\t\treturn sha512.New(), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512\", algo)\n\t}\n}\n\n// Fingerprint applies fingerprinting of the given resource and hash algorithm.\n// It defaults to sha256 if none given, and the options are md5, sha256 or sha512.\n// The same algo is used for both the fingerprinting part (aka cache busting) and\n// the base64-encoded Subresource Integrity hash, so you will have to stay away from\n// md5 if you plan to use both.\n// See https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity\nfunc (c *Client) Fingerprint(res resources.ResourceTransformer, algo string) (resource.Resource, error) {\n\tif algo == \"\" {\n\t\talgo = defaultHashAlgo\n\t}\n\n\treturn res.Transform(&fingerprintTransformation{algo: algo})\n}\n\nfunc integrity(algo string, sum []byte) string {","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/gohugoio/hugo/blob/8a468df065a75c1c7cf9f6850f32148746590ea5/resources/resource_transformers/integrity/integrity.go#L76-L112","documentation":"The integrity/fingerprint transformer builds a hash.Hash from the algorithm name passed to `resources.Fingerprint`. Only md5, sha256, sha384, and sha512 are supported; any other string hits the default case in newHash and returns this error. The same algorithm feeds both the cache-busting filename suffix and the base64 Subresource Integrity value.","triggerScenarios":"Calling `{{ $r := $css | resources.Fingerprint \"sha1\" }}` (or any unsupported/misspelled algorithm like \"SHA256\", \"sha-256\", \"crc32\") in a template. The empty string is fine — it defaults to sha256.","commonSituations":"Typos or wrong casing in the algorithm argument; copying snippets that use \"sha1\" from other tooling; passing an options dict or wrong variable as the second argument so a non-algorithm string arrives.","solutions":["Use one of the exact lowercase names: `resources.Fingerprint \"sha512\"` (or md5, sha256, sha384).","Omit the argument to get the sha256 default: `{{ $r := $css | fingerprint }}`.","Avoid md5 if you emit the value as an `integrity` attribute — browsers reject md5 for SRI."],"exampleFix":"// before\n{{ $css := $css | resources.Fingerprint \"sha-256\" }}\n// after\n{{ $css := $css | resources.Fingerprint \"sha256\" }}","handlingStrategy":"validation","validationCode":"var validAlgos = map[string]bool{\"md5\": true, \"sha256\": true, \"sha384\": true, \"sha512\": true}\nif !validAlgos[strings.ToLower(algo)] {\n    return fmt.Errorf(\"unsupported hash algorithm %q; use md5, sha256, sha384 or sha512\", algo)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist-validate the algorithm argument to resources.Fingerprint before calling it","Prefer the default (sha256) unless a specific algorithm is required","Lowercase and trim user/config-supplied algorithm names before use"],"tags":["hugo","fingerprint","sri","hashing","templates"],"analyzedSha":"8a468df065a75c1c7cf9f6850f32148746590ea5","analyzedAt":"2026-07-31T21:23:07.045Z","schemaVersion":2}