{"record":{"id":"b04544b9a6c8bf17","repo":"theonedev/onedev","slug":"unexpected-integrity-algorithm-file-s-algorith","errorCode":null,"errorMessage":"Unexpected integrity algorithm (file: %s, algorithm: %s)","messagePattern":"Unexpected integrity algorithm \\(file: (.+?), algorithm: (.+?)\\)","errorType":"http","errorClass":"ClientException","httpStatus":400,"severity":"error","filePath":"server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java","lineNumber":447,"sourceCode":"\t\t\t\t\t\t\t\t\t\tif (distNode != null) {\n\t\t\t\t\t\t\t\t\t\t\tvar fileName = substringAfterLast(distNode.get(\"tarball\").asText(), \"-/\");\n\t\t\t\t\t\t\t\t\t\t\tvar fileContent = attachments.get(fileName);\n\t\t\t\t\t\t\t\t\t\t\tif (fileContent != null) {\n\t\t\t\t\t\t\t\t\t\t\t\tvar integrity = distNode.get(\"integrity\").asText();\n\t\t\t\t\t\t\t\t\t\t\t\tvar algorithm = substringBefore(integrity, \"-\");\n\t\t\t\t\t\t\t\t\t\t\t\tvar hash = Base64.decodeBase64(substringAfter(integrity, \"-\"));\n\t\t\t\t\t\t\t\t\t\t\t\tif (algorithm.equals(\"sha512\")) {\n\t\t\t\t\t\t\t\t\t\t\t\t\tif (!Arrays.equals(decodeHex(Digest.sha512Of(fileContent).getHash()), hash)) {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tthrow new ClientException(SC_BAD_REQUEST, \"Integrity check failed: \" + fileName);\n\t\t\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\t\t} else if (algorithm.equals(\"sha1\")) {\n\t\t\t\t\t\t\t\t\t\t\t\t\tif (!Arrays.equals(decodeHex(Digest.sha1Of(fileContent).getHash()), hash)) {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tthrow new ClientException(SC_BAD_REQUEST, \"Integrity check failed: \" + fileName);\n\t\t\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\t\t\t\tvar errorMessage = String.format(\"Unexpected integrity algorithm (file: %s, algorithm: %s)\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tfileName, algorithm);\n\t\t\t\t\t\t\t\t\t\t\t\t\tthrow new ClientException(SC_BAD_REQUEST, errorMessage);\n\t\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\t\tvar packBlobId = packBlobService.uploadBlob(projectId, fileContent, null);\n\t\t\t\t\t\t\t\t\t\t\t\tvar sha256Hash = packBlobService.load(packBlobId).getSha256Hash();\n\t\t\t\t\t\t\t\t\t\t\t\tpack.setData(new NpmData(packageMetadataBytes, versionMetadataBytes, distTagsOfVersion, fileName, sha256Hash));\n\t\t\t\t\t\t\t\t\t\t\t\tpackService.createOrUpdate(pack, newArrayList(packBlobService.load(packBlobId)), true);\n\t\t\t\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_CREATED);\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t} catch (IOException e) {\n\t\t\t\t\t\tthrow new RuntimeException(e);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tthrow new ClientException(SC_METHOD_NOT_ALLOWED);\n\t\t\t\t}","sourceCodeStart":429,"sourceCodeEnd":465,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java#L429-L465","documentation":"Thrown during npm package publish when the integrity field in the version metadata uses an algorithm other than sha512 or sha1. OneDev only understands these two hash algorithms for validating the uploaded tarball and rejects the request with HTTP 400. The error message includes the file name and the unrecognized algorithm prefix from dist.integrity.","triggerScenarios":"PUT publish request where substringBefore(dist.integrity, \"-\") is not 'sha512' or 'sha1' — e.g. an integrity string like 'sha384-...' or a custom hash prefix.","commonSituations":"Publishing tooling that emits sha384 or md5 integrity values; hand-crafted or migrated package metadata where the integrity field was replaced; third-party mirrors that rewrite integrity to an unsupported algorithm.","solutions":["Regenerate the package metadata so dist.integrity uses sha512 (the npm default), e.g. by publishing with standard npm/yarn tooling.","If you control the publish payload, compute a sha512 integrity: Base64 of SHA-512 of the tarball, formatted as 'sha512-<base64>'.","Check the publishing client/mirror configuration for an option forcing a different hash algorithm and switch it to sha512."],"exampleFix":"// before\n\"integrity\": \"sha384-AbCd...\"\n// after\n\"integrity\": \"sha512-<base64 sha512 of tarball>\"","handlingStrategy":"validation","validationCode":"// Ensure integrity uses a supported algorithm before publishing\nconst integrity = pkg.dist.integrity;\nconst algo = integrity.split('-')[0];\nif (algo !== 'sha512' && algo !== 'sha1') throw new Error(`Unsupported integrity algorithm: ${algo}`);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use sha512 integrity values (the npm default).","Avoid hand-editing package metadata integrity fields.","Check mirror/publish tooling for configurable hash algorithms."],"tags":["npm","unsupported-algorithm","http-400"],"backgroundTag":"unsupported-enum-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}