{"record":{"id":"da58e50f858374e6","repo":"theonedev/onedev","slug":"checksum-verification-failed","errorCode":null,"errorMessage":"Checksum verification failed","messagePattern":"Checksum verification failed","errorType":"http","errorClass":"HttpResponseAwareException","httpStatus":400,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":368,"sourceCode":"\t\t\t\tLockUtils.run(lockName, () -> transactionService.run(() -> {\n\t\t\t\t\tvar project = projectService.load(projectId);\n\t\t\t\t\tPack pack = findPack(project, groupId, artifactId, version);\n\t\t\t\t\tif (pack != null) {\n\t\t\t\t\t\tMavenData data = (MavenData) pack.getData();\n\t\t\t\t\t\tvar sha256BlobHash = data.getSha256BlobHashes().get(blobName);\n\t\t\t\t\t\tif (sha256BlobHash != null) {\n\t\t\t\t\t\t\tPackBlob packBlob;\n\t\t\t\t\t\t\tif ((packBlob = packBlobService.checkPackBlob(projectId, sha256BlobHash)) != null) {\n\t\t\t\t\t\t\t\tString blobHash;\n\t\t\t\t\t\t\t\tif (fileName.endsWith(EXT_SHA256))\n\t\t\t\t\t\t\t\t\tblobHash = sha256BlobHash;\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\tblobHash = getNonSha256Hash(packBlob, fileName);\n\t\t\t\t\t\t\t\tif (blobHash.equals(checksum)) {\n\t\t\t\t\t\t\t\t\tpackBlobReferenceService.createIfNotExist(pack, packBlob);\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_OK);\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Checksum verification failed\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown file to verify checksum\");\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown GAV to verify checksum\");\n\t\t\t\t\t}\n\t\t\t\t}));\t\t\t\n\t\t\t} else {\n\t\t\t\tvar packBlobId = packBlobService.uploadBlob(projectId, is, null);\n\t\t\t\tvar sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());\n\t\t\t\tLockUtils.run(lockName, () -> transactionService.run(() -> {\n\t\t\t\t\tvar project = projectService.load(projectId);\n\t\t\t\t\tPack pack = findPack(project, groupId, artifactId, version);\n\t\t\t\t\tif (pack == null) {","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L350-L386","documentation":"Thrown during checksum verification in uploadBlob: the checksum content supplied by the client does not match the hash OneDev computes over the already-uploaded pack blob (SHA-256 or, for legacy .md5/.sha1 names, a non-SHA256 hash). The handler responds with HTTP 400 to protect the repository from corrupted uploads.","triggerScenarios":"A Maven client (e.g. mvn deploy with checksum policies) uploads a .sha1/.md5 file whose contents differ from the stored blob's computed hash for the same artifact file name in the same GAV.","commonSituations":"Artifact was modified after the checksum was generated (partially written file, re-built jar without regenerating checksums); local repository corruption; different hashing algorithm than the file suffix implies; transferring files via text mode corrupting binaries.","solutions":["Re-generate the checksum from the exact artifact being uploaded (mvn deploy regenerates them automatically; avoid hand-copied checksums).","Verify the local artifact file is not corrupted (compare with the build output); rebuild and redeploy if needed.","Ensure the checksum file suffix matches the algorithm (.sha1 → SHA-1, .md5 → MD5) and file contents are the plain hex digest.","Clean stale checksum files in your local build output so outdated digests are not uploaded."],"exampleFix":"// before — stale checksum alongside rebuilt jar\n$ sha1sum target/app-1.0.jar  # differs from target/app-1.0.jar.sha1\n// after — regenerate before upload\nmvn clean deploy   # regenerates jar and matching .sha1/.md5","handlingStrategy":"validation","validationCode":"# Verify the checksum matches the artifact locally before uploading\nART=target/app-1.0.jar\ncase \"$ART\" in\n  *.sha1) sha1sum \"$ART\" | awk '{print $1}' > /tmp/expected ;;\n  *.md5)  md5sum  \"$ART\" | awk '{print $1}' > /tmp/expected ;;\n  *)      sha256sum \"$ART\" | awk '{print $1}' > /tmp/expected ;;\nesac\ndiff /tmp/expected \"${ART%.*}$(basename $ART).$(basename $ART)\" 2>/dev/null || cmp -s /tmp/expected \"$ART.sha1\" && echo OK || { echo 'checksum mismatch locally'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use the build tool (mvn deploy / gradle publish) to publish — it regenerates checksums consistently.","Never hand-edit or copy checksum files between builds.","Run `mvn clean` before release builds so stale artifacts/checksums are not reused."],"tags":["maven","checksum","upload","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}