theonedev/onedev · error · HttpResponseAwareException

Checksum verification failed

Error message

Checksum verification failed

What it means

Thrown during checksum verification in uploadBlob: the checksum content supplied by the client does not match the hash OneDev computes over the already-uploaded pack blob (SHA-256 or, for legacy .md5/.sha1 names, a non-SHA256 hash). The handler responds with HTTP 400 to protect the repository from corrupted uploads.

Source

Thrown at server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java:368

				LockUtils.run(lockName, () -> transactionService.run(() -> {
					var project = projectService.load(projectId);
					Pack pack = findPack(project, groupId, artifactId, version);
					if (pack != null) {
						MavenData data = (MavenData) pack.getData();
						var sha256BlobHash = data.getSha256BlobHashes().get(blobName);
						if (sha256BlobHash != null) {
							PackBlob packBlob;
							if ((packBlob = packBlobService.checkPackBlob(projectId, sha256BlobHash)) != null) {
								String blobHash;
								if (fileName.endsWith(EXT_SHA256))
									blobHash = sha256BlobHash;
								else
									blobHash = getNonSha256Hash(packBlob, fileName);
								if (blobHash.equals(checksum)) {
									packBlobReferenceService.createIfNotExist(pack, packBlob);
									response.setStatus(SC_OK);
								} else {
									throw new HttpResponseAwareException(SC_BAD_REQUEST, "Checksum verification failed");
								}
							} else {
								throw new HttpResponseAwareException(SC_BAD_REQUEST);
							}
						} else {
							throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown file to verify checksum");
						}
					} else {
						throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown GAV to verify checksum");
					}
				}));			
			} else {
				var packBlobId = packBlobService.uploadBlob(projectId, is, null);
				var sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());
				LockUtils.run(lockName, () -> transactionService.run(() -> {
					var project = projectService.load(projectId);
					Pack pack = findPack(project, groupId, artifactId, version);
					if (pack == null) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Re-generate the checksum from the exact artifact being uploaded (mvn deploy regenerates them automatically; avoid hand-copied checksums).
2. Verify the local artifact file is not corrupted (compare with the build output); rebuild and redeploy if needed.
3. Ensure the checksum file suffix matches the algorithm (.sha1 → SHA-1, .md5 → MD5) and file contents are the plain hex digest.
4. Clean stale checksum files in your local build output so outdated digests are not uploaded.

Example fix

// before — stale checksum alongside rebuilt jar
$ sha1sum target/app-1.0.jar  # differs from target/app-1.0.jar.sha1
// after — regenerate before upload
mvn clean deploy   # regenerates jar and matching .sha1/.md5

# Verify the checksum matches the artifact locally before uploading
ART=target/app-1.0.jar
case "$ART" in
  *.sha1) sha1sum "$ART" | awk '{print $1}' > /tmp/expected ;;
  *.md5)  md5sum  "$ART" | awk '{print $1}' > /tmp/expected ;;
  *)      sha256sum "$ART" | awk '{print $1}' > /tmp/expected ;;
esac
diff /tmp/expected "${ART%.*}$(basename $ART).$(basename $ART)" 2>/dev/null || cmp -s /tmp/expected "$ART.sha1" && echo OK || { echo 'checksum mismatch locally'; exit 1; }

When it happens

Trigger: A Maven client (e.g. mvn deploy with checksum policies) uploads a .sha1/.md5 file whose contents differ from the stored blob's computed hash for the same artifact file name in the same GAV.

Common situations: Artifact was modified after the checksum was generated (partially written file, re-built jar without regenerating checksums); local repository corruption; different hashing algorithm than the file suffix implies; transferring files via text mode corrupting binaries.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• Checksum exceeds maximum size: ${MAX_CHECKSUM_LEN}
• Unknown file to verify checksum
• Unknown GAV to verify checksum
• Invalid blob size: %s
• No package write permission for project: ${project.getPath()

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/da58e50f858374e6. Report an issue: GitHub.