theonedev/onedev · error · ExplicitException

Pack blob missing or corrupted: ${sha256BlobHash}

Error message

Pack blob missing or corrupted: ${sha256BlobHash}

What it means

GemPackHandler.download throws this ExplicitException when serving a gem package whose stored pack blob reference exists but whose underlying blob content cannot be retrieved or whose SHA-256 hash does not match the recorded hash. It guards against serving corrupted or incomplete package data to gem clients. The blob store lookup returned null content or failed integrity verification against the persisted sha256BlobHash.

Source

Thrown at server-plugin/server-plugin-pack-gem/src/main/java/io/onedev/server/plugin/pack/gem/GemPackHandler.java:423

			sessionService.run(() -> {
				var project = checkProject(projectId, false);
				var pack = findPack(project, nameAndVersion);
				if (pack != null) {
					var data = (GemData) pack.getData();
					var sha256BlobHash = data.getSha256BlobHashes().get(fileName);
					if (sha256BlobHash != null) {
						PackBlob packBlob;
						if ((packBlob = packBlobService.findBySha256Hash(projectId, sha256BlobHash)) != null) {
							response.setContentType(MediaType.APPLICATION_OCTET_STREAM);
							try {
								packBlobService.downloadBlob(packBlob.getProject().getId(),
										packBlob.getSha256Hash(), response.getOutputStream());
							} catch (IOException e) {
								throw new RuntimeException(e);
							}
							response.setStatus(SC_OK);
						} else {
							throw new ExplicitException("Pack blob missing or corrupted: " + sha256BlobHash);
						}
					} else {
						response.setStatus(SC_NOT_FOUND);
					}
				} else {
					response.setStatus(SC_NOT_FOUND);
				}
			});			
		} else {
			response.setStatus(SC_NOT_FOUND);
		}
	}
	
	private boolean isPrerelease(String version) {
		for (var ch: version.toCharArray()) {
			if (Character.isLetter(ch))
				return true;
		}

View on GitHub (pinned to d44925c47c)

Solutions

1. Delete the affected package version in the project's Packages screen and re-publish (gem push) so the blob is re-uploaded with a valid hash.
2. Check the server blob storage directory (site blobs) for the missing file and restore it from backup or another instance.
3. Verify disk health/free space on the OneDev server; a full disk during upload commonly produces truncated blobs.
4. Check server logs around the time the package was published for blob write errors.

Example fix

// Not a code fix on the caller side; server-side re-publish
# delete corrupted version in OneDev UI: Project -> Packages -> gem package -> delete version
# then from client
gem push mygem-1.0.0.gem

try {
    gemClient.fetch(spec);
} catch (e) {
    if (String(e).includes('missing or corrupted')) {
        // re-push package or notify admin to restore blob store from backup
    } else throw e;
}

When it happens

Trigger: GET request for a gem/gemspec download resolves a PackBlob by hash but PackService.downloadBlob returns null or throws because the blob file is absent from the blob store, or the recomputed SHA-256 does not equal packBlob.getSha256Hash() before streaming to response.getOutputStream().

Common situations: Blob store on disk was pruned/cleaned manually or by a GC bug while pack metadata rows remained; interrupted upload left a dangling reference; disk corruption or migration between OneDev instances copied the database but not the blobs directory.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• Invalid blob size: %s
• Package management not enabled for project '${project.path}'
• No package write permission for project: ${project.path}
• No package read permission for project: ${project.path}
• Unable to find version node

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/116db62115aed124. Report an issue: GitHub.