theonedev/onedev · error · ClientException

Unexpected integrity algorithm (file: %s, algorithm: %s)

Error message

Unexpected integrity algorithm (file: %s, algorithm: %s)

What it means

Thrown during npm package publish when the integrity field in the version metadata uses an algorithm other than sha512 or sha1. OneDev only understands these two hash algorithms for validating the uploaded tarball and rejects the request with HTTP 400. The error message includes the file name and the unrecognized algorithm prefix from dist.integrity.

Source

Thrown at server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java:447

										if (distNode != null) {
											var fileName = substringAfterLast(distNode.get("tarball").asText(), "-/");
											var fileContent = attachments.get(fileName);
											if (fileContent != null) {
												var integrity = distNode.get("integrity").asText();
												var algorithm = substringBefore(integrity, "-");
												var hash = Base64.decodeBase64(substringAfter(integrity, "-"));
												if (algorithm.equals("sha512")) {
													if (!Arrays.equals(decodeHex(Digest.sha512Of(fileContent).getHash()), hash)) {
														throw new ClientException(SC_BAD_REQUEST, "Integrity check failed: " + fileName);
													}
												} else if (algorithm.equals("sha1")) {
													if (!Arrays.equals(decodeHex(Digest.sha1Of(fileContent).getHash()), hash)) {
														throw new ClientException(SC_BAD_REQUEST, "Integrity check failed: " + fileName);
													}
												} else {
													var errorMessage = String.format("Unexpected integrity algorithm (file: %s, algorithm: %s)",
															fileName, algorithm);
													throw new ClientException(SC_BAD_REQUEST, errorMessage);
												}
												var packBlobId = packBlobService.uploadBlob(projectId, fileContent, null);
												var sha256Hash = packBlobService.load(packBlobId).getSha256Hash();
												pack.setData(new NpmData(packageMetadataBytes, versionMetadataBytes, distTagsOfVersion, fileName, sha256Hash));
												packService.createOrUpdate(pack, newArrayList(packBlobService.load(packBlobId)), true);
												response.setStatus(SC_CREATED);
											}
										}
									});
								});
							}
						}
					} catch (IOException e) {
						throw new RuntimeException(e);
					}
				} else {
					throw new ClientException(SC_METHOD_NOT_ALLOWED);
				}

View on GitHub (pinned to d44925c47c)

Solutions

1. Regenerate the package metadata so dist.integrity uses sha512 (the npm default), e.g. by publishing with standard npm/yarn tooling.
2. If you control the publish payload, compute a sha512 integrity: Base64 of SHA-512 of the tarball, formatted as 'sha512-<base64>'.
3. Check the publishing client/mirror configuration for an option forcing a different hash algorithm and switch it to sha512.

Example fix

// before
"integrity": "sha384-AbCd..."
// after
"integrity": "sha512-<base64 sha512 of tarball>"

// Ensure integrity uses a supported algorithm before publishing
const integrity = pkg.dist.integrity;
const algo = integrity.split('-')[0];
if (algo !== 'sha512' && algo !== 'sha1') throw new Error(`Unsupported integrity algorithm: ${algo}`);

When it happens

Trigger: PUT publish request where substringBefore(dist.integrity, "-") is not 'sha512' or 'sha1' — e.g. an integrity string like 'sha384-...' or a custom hash prefix.

Common situations: Publishing tooling that emits sha384 or md5 integrity values; hand-crafted or migrated package metadata where the integrity field was replaced; third-party mirrors that rewrite integrity to an unsupported algorithm.

Related errors

• Invalid request path
• File length incorrect:
• Integrity check failed:
• Missing version or file name
• Incorrect file name requested

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/b04544b9a6c8bf17. Report an issue: GitHub.