{"record":{"id":"e95d3dfbeafbd202","repo":"theonedev/onedev","slug":"unknown-gav-to-verify-checksum","errorCode":null,"errorMessage":"Unknown GAV to verify checksum","messagePattern":"Unknown GAV to verify checksum","errorType":"http","errorClass":"HttpResponseAwareException","httpStatus":400,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":377,"sourceCode":"\t\t\t\t\t\t\t\tString blobHash;\n\t\t\t\t\t\t\t\tif (fileName.endsWith(EXT_SHA256))\n\t\t\t\t\t\t\t\t\tblobHash = sha256BlobHash;\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\tblobHash = getNonSha256Hash(packBlob, fileName);\n\t\t\t\t\t\t\t\tif (blobHash.equals(checksum)) {\n\t\t\t\t\t\t\t\t\tpackBlobReferenceService.createIfNotExist(pack, packBlob);\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_OK);\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Checksum verification failed\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown file to verify checksum\");\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new HttpResponseAwareException(SC_BAD_REQUEST, \"Unknown GAV to verify checksum\");\n\t\t\t\t\t}\n\t\t\t\t}));\t\t\t\n\t\t\t} else {\n\t\t\t\tvar packBlobId = packBlobService.uploadBlob(projectId, is, null);\n\t\t\t\tvar sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());\n\t\t\t\tLockUtils.run(lockName, () -> transactionService.run(() -> {\n\t\t\t\t\tvar project = projectService.load(projectId);\n\t\t\t\t\tPack pack = findPack(project, groupId, artifactId, version);\n\t\t\t\t\tif (pack == null) {\n\t\t\t\t\t\tpack = new Pack();\n\t\t\t\t\t\tpack.setProject(project);\n\t\t\t\t\t\tpack.setType(TYPE);\n\t\t\t\t\t\tpack.setName(getName(groupId, artifactId));\n\t\t\t\t\t\tpack.setVersion(version != null? version: NONE);\n\t\t\t\t\t\tpack.setPrerelease(version != null && version.endsWith(VERSION_SUFFIX_SNAPSHOT));\n\t\t\t\t\t\tpack.setData(new MavenData());\n\t\t\t\t\t}\n\t\t\t\t\t","sourceCodeStart":359,"sourceCodeEnd":395,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L359-L395","documentation":"During checksum verification in uploadBlob, after the file name is recognized, the pack itself is looked up via findPack(project, groupId, artifactId, version). If no pack exists for the supplied GAV, the handler throws HTTP 400 'Unknown GAV to verify checksum' — a checksum cannot be attached to a package that does not exist.","triggerScenarios":"A client uploads a .sha1/.md5/.sha256 file for a groupId/artifactId/version combination that was never published to the project (artifact upload skipped/failed, or coordinates in the URL are wrong).","commonSituations":"Deploy failed midway leaving only checksum uploads; typo in repository path coordinates; uploading checksums against a project that never received the artifact; release version vs snapshot mix-up in the URL.","solutions":["Publish the artifact (the full jar/pom) for that GAV first, then upload checksums.","Check the repository URL path segments — groupId is derived from directory segments, artifactId is the last file's base name; fix typos.","Verify the version in the URL matches the deployed version exactly (e.g. 1.0.0 vs 1.0.0-SNAPSHOT)."],"exampleFix":"// before\ncurl -T app-1.0.jar.sha1 \"$URL/com/acme/app/1.0.1/app-1.0.1.jar.sha1\"  # 1.0.1 never deployed\n// after\ncurl -T app-1.0.jar \"$URL/com/acme/app/1.0.0/app-1.0.0.jar\"\ncurl -T app-1.0.jar.sha1 \"$URL/com/acme/app/1.0.0/app-1.0.0.jar.sha1\"","handlingStrategy":"validation","validationCode":"# Before uploading checksums, confirm the GAV exists in the project\nGAV_PATH=\"com/acme/app/1.0.0\"\nSTATUS=$(curl -s -o /dev/null -w '%{http_code}' -u \"$USER:$TOKEN\" \"$BASE/~maven/1/$GAV_PATH/app-1.0.0.pom\")\n[ \"$STATUS\" = \"200\" ] || { echo \"GAV not published (HTTP $STATUS); deploy artifact first\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy artifacts and their checksums in one script so ordering is guaranteed.","Double-check URL coordinates against the pom's groupId/artifactId/version.","Use distinct release vs snapshot repository URLs to avoid version mix-ups."],"tags":["maven","checksum","gav","upload"],"backgroundTag":"resource-not-found","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}