Deploy command fails on Deno with ERR_CRYPTO_HASH_FINALIZED

[Garciat]

Describe the bug

It seems like Deno's polyfill for Node's crypto.Hash considers .end() as a finalization of the object, and so a following call to .digest('hex') fails with ERR_CRYPTO_HASH_FINALIZED.

This happens in src/utils/deploy/hasher-segments.ts function hashFile():

const hashFile = async (filePath: string, algorithm: string) => {
  const hasher = createHash(algorithm)
  await pipeline([createReadStream(filePath), hasher])

  return hasher.digest('hex')
}

pipeline() indirectly ends the hasher write stream after consuming the read stream. So the following call to hasher.digest('hex') results in an exception.

A solution that worked for me is providing { end: false } as a second parameter to pipeline(). (I also verified that this does not break running the command from node.js.)

See: Garciat/netlify-cli@main...garciat/fix-deno-digest-already-called

An alternative would be to use hasher.read().toString('hex') instead of hasher.digest('hex'), which only reads the hash result (assuming that .end() was called previously) instead of trying to finalize the hash object. However, I find this approach a bit too implicit/indirect.

Steps to reproduce

Given a project that has already been configured for deployment:

deno run -A npm:netlify-cli deploy

The output was:

[...etc...]
❯ Context
✔ Finished uploading blobs to deploy store
✔ No cached functions were found
⠦ Hashing files... ›   Warning: 
{
  "code": "ERR_CRYPTO_HASH_FINALIZED",
  "name": "Error"
}

 ›   Error: Digest already called

Configuration

No response

Environment

  System:
    OS: macOS 15.3.1
    CPU: (8) arm64 Apple M1
    Memory: 96.05 MB / 8.00 GB
    Shell: 5.9 - /opt/homebrew/bin/zsh
  Binaries:
    Node: 23.7.0 - /opt/homebrew/bin/node
    npm: 11.1.0 - /opt/homebrew/bin/npm
  npmPackages:
    netlify-cli: ^18.1.0 => 18.1.0 

[serhalp]

Hi @Garciat, thanks for the great bug report!

Coincidentally we just merged a change to that code that uses the native pipeline: #7096.

May I give you a ping here when that change is released so that you can confirm whether this still occurs?

Thanks!

[Garciat]

Sure thing! Thank you