MD5 checksum validation fails for custom code containing non-ASCII characters #645

Activity

1. Patrick Nilan (pnilan)

   added

   communityPRs and issues from community contributorsPRs and issues from community contributors

   on Jul 31, 2026
2. bazarnov commented on Sep 28, 2026

   

   Baz (bazarnov)

   on Sep 28, 2026

   Contributor

   More actions

   Thanks for the report. I traced this down.

   Trigger: any backslash in the custom components code, e.g. \uXXXX escapes, '\n' inside strings, regexes like r'\d+', '\\', or a line continuation. Raw non-ASCII text (Chinese characters, emoji) is not the problem by itself. The same text written directly, without escapes, validates fine.

   Root cause: the CDK is not the problem. When a connector is published, the Airbyte platform computes the stored md5 over a Java-unescaped copy of the code instead of the exact text it passes to the connector. For code with a backslash the two differ, so the CDK's check fails with AirbyteCodeTamperedError. No CDK change is needed for this.

   Status: a fix is in progress in the platform. I will update this issue when it ships in a release.

   Workaround until then: remove backslashes from components.py, then publish a new version:

   • write non-ASCII characters directly ('中文') or use chr(0x4e2d) instead of '\u4e2d'
   • use chr(10) instead of '\n'
   • use character classes such as [0-9] instead of \d (for ASCII digits)
   • wrap expressions in parentheses instead of using \ line continuations
   • for any other escape, build the backslash at runtime, e.g. BS = chr(92), then re.compile(BS + "s+")

   After the fix ships, connectors that are already affected also need a new version published, or the active version switched, so the checksum is recomputed.
3. bazarnov commented on Oct 2, 2026

   

   Baz (bazarnov)

   on Oct 2, 2026

   Contributor

   More actions

   Fixed on the platform side. The root cause was not in the CDK: the Connector Builder computed __injected_components_py_checksums over a Java-unescaped copy of components.py, so any code with a backslash (not only non-ASCII) failed the CDK check. The platform now hashes the exact text it injects, as UTF-8, which is what validate_python_code hashes.

   Definitions published before the fix keep their stored checksum: publish a new version (or switch the active version) to recompute it.

   Related CDK change: #1196 removes the components code from the AirbyteCodeTamperedError message.
4. Baz (bazarnov)

   closed this as completedon Oct 2, 2026