theonedev/onedev · critical · ExplicitException

Pack blob missing or corrupted: ${sha256}

Error message

Pack blob missing or corrupted: ${sha256}

What it means

The package record exists but its registered nupkg blob (looked up by SHA-256 hash) is missing or fails the integrity check, so the handler throws ExplicitException('Pack blob missing or corrupted: <sha256>') — an internal inconsistency between the pack metadata and the blob store.

Source

Thrown at server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java:510

					if (pack != null) {
						var data = (NugetData) pack.getData();
						if (fileName.endsWith(".nuspec")) {
							try {
								response.getOutputStream().write(data.getMetadata());
							} catch (IOException e) {
								throw new RuntimeException(e);
							}
						} else {
							PackBlob packBlob;
							if ((packBlob = packBlobService.checkPackBlob(projectId, data.getNupkgBlobSha256Hash())) != null) {
								try {
									packBlobService.downloadBlob(packBlob.getProject().getId(), 
											packBlob.getSha256Hash(), response.getOutputStream());
								} catch (IOException e) {
									throw new RuntimeException(e);
								}
							} else {
								throw new ExplicitException("Pack blob missing or corrupted: " + data.getNupkgBlobSha256Hash());
							}
						}
						response.setStatus(SC_OK);
					} else {
						response.setStatus(SC_NOT_FOUND);
					}
				});
			}
		} else {
			response.setStatus(SC_NOT_FOUND);
		}
	}
	
	private Map<String, Object> getLeafValue(Pack pack, SAXReader saxReader, String baseUrl) {
		var leafValue = new HashMap<String, Object>();
		leafValue.put("@id", getRegistrationLeafUrl(baseUrl, pack.getName(), pack.getVersion()));
		leafValue.put("packageContent", getPackageDownloadUrl(baseUrl, pack.getName(), pack.getVersion()));

View on GitHub (pinned to d44925c47c)

Solutions

  1. Re-publish the affected package version to regenerate the blob and repair the reference
  2. Restore the missing blob from backup (server site/blob storage) matching the reported sha256 hash
  3. Audit any storage cleanup jobs/scripts that delete files under OneDev's site directory
  4. Check server logs around the time blob storage was modified; run integrity checks on the storage volume
  5. If the record is unrecoverable, delete the pack entry and republish

Example fix

// server-side remediation
// before: GET .../package/My.Package/1.2.3/My.Package.1.2.3.nupkg -> 500 Pack blob missing or corrupted: abc123...
// after:
# restore the blob file for sha256 abc123... from backup into OneDev's site/blob store, or
curl -u user:token -X PUT --upload-file My.Package.1.2.3.nupkg https://onedev.example.com/~nuget/project-x/   # republish
Defensive patterns

Strategy: fallback

Validate before calling

# detect corruption before relying on the feed
url=$(registration-leaf-url for pkg/version)
curl -fsSI "$url" || echo "package content unavailable — plan republish"

Try / catch

try {
  await download(nupkgUrl);
} catch (e) {
  if (/Pack blob missing or corrupted/.test(String(e))) {
    await republishPackage(pkg); // restore from your .nupkg artifact cache
  } else throw e;
}

Prevention

When it happens

Trigger: GET package/{id}/{version}/{file>.nupkg} where packBlobService.checkPackBlob(projectId, data.getNupkgBlobSha256Hash()) returns null: the blob row/file is absent or its hash no longer matches (corruption).

Common situations: Manual deletion or cleanup of the server's blob storage directory; failed/incomplete backups and restores; disk corruption or accidental pruning jobs; DB rows kept while underlying blob files were wiped (or vice versa).

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a8a3d9095af7339c. Report an issue: GitHub.