{"record":{"id":"a8283c66474fd741","repo":"theonedev/onedev","slug":"unknown-file-to-verify-checksum","errorCode":null,"errorMessage":"Unknown file to verify checksum","messagePattern":"Unknown file to verify checksum","errorType":"http","errorClass":"HttpResponseAwareException","httpStatus":400,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":374,"sourceCode":"\t\t\t\t\t\tif (sha256BlobHash != null) {\n\t\t\t\t\t\t\tPackBlob packBlob;\n\t\t\t\t\t\t\tif ((packBlob = packBlobService.checkPackBlob(projectId, sha256BlobHash)) != null) {\n\t\t\t\t\t\t\t\tString blobHash;\n\t\t\t\t\t\t\t\tif (fileName.endsWith(EXT_SHA256))\n\t\t\t\t\t\t\t\t\tblobHash = sha256BlobHash;\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\tblobHash = getNonSha256Hash(packBlob, fileName);\n\t\t\t\t\t\t\t\tif (blobHash.equals(checksum)) {\n\t\t\t\t\t\t\t\t\tpackBlobReferenceService.createIfNotExist(pack, packBlob);\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_OK);\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Checksum verification failed\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown file to verify checksum\");\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown GAV to verify checksum\");\n\t\t\t\t\t}\n\t\t\t\t}));\t\t\t\n\t\t\t} else {\n\t\t\t\tvar packBlobId = packBlobService.uploadBlob(projectId, is, null);\n\t\t\t\tvar sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());\n\t\t\t\tLockUtils.run(lockName, () -> transactionService.run(() -> {\n\t\t\t\t\tvar project = projectService.load(projectId);\n\t\t\t\t\tPack pack = findPack(project, groupId, artifactId, version);\n\t\t\t\t\tif (pack == null) {\n\t\t\t\t\t\tpack = new Pack();\n\t\t\t\t\t\tpack.setProject(project);\n\t\t\t\t\t\tpack.setType(TYPE);\n\t\t\t\t\t\tpack.setName(getName(groupId, artifactId));\n\t\t\t\t\t\tpack.setVersion(version != null? version: NONE);\n\t\t\t\t\t\tpack.setPrerelease(version != null && version.endsWith(VERSION_SUFFIX_SNAPSHOT));","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L356-L392","documentation":"In uploadBlob's checksum-verification branch, the handler looks up the uploaded file name among the pack's known blob hashes (data.getSha256BlobHashes(), or the main artifact) to compare against the supplied checksum. If the file name does not correspond to any blob recorded for that pack, it throws HTTP 400 'Unknown file to verify checksum'.","triggerScenarios":"A client uploads a checksum file (.sha1/.md5/.sha256) for a file name that has never been uploaded to that GAV — e.g. checksum arrives before its artifact, the artifact name is misspelled, or the checksum targets a file belonging to a different version.","commonSituations":"Out-of-order uploads where a retried checksum upload lands after the artifact was cleaned; typo'd artifact file name; uploading checksums for artifacts managed by a different pack (release vs snapshot).","solutions":["Upload the artifact itself first, then its checksum file — checksums can only verify already-stored blobs.","Confirm the checksum file name exactly matches the artifact file name already present in the pack.","Verify you are uploading to the same groupId/artifactId/version the artifact was uploaded under."],"exampleFix":"// before — checksum for unuploaded file\ncurl -T lib-1.0.jar.md5 \"$URL/.../lib-2.0.jar.md5\"\n// after — upload artifact then matching checksum\ncurl -T lib-1.0.jar \"$URL/.../lib-1.0.jar\"\ncurl -T lib-1.0.jar.md5 \"$URL/.../lib-1.0.jar.md5\"","handlingStrategy":"validation","validationCode":"# Ensure each checksum upload has its artifact already deployed\nfor cs in target/*.sha1 target/*.md5; do\n  art=\"${cs%.*}\"\n  [ -f \"target/deployed/$(basename \"$art\")\" ] || { echo \"artifact $art not deployed yet\"; exit 1; }\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Upload artifacts before checksums in custom upload scripts.","Keep artifact and checksum names generated from the same variable to avoid typos.","Deploy whole version directories atomically where possible."],"tags":["maven","checksum","upload","artifact-not-found"],"backgroundTag":"resource-not-found","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}