theonedev/onedev · error · HttpResponseAwareException

Unknown file to verify checksum

Error message

Unknown file to verify checksum

What it means

In uploadBlob's checksum-verification branch, the handler looks up the uploaded file name among the pack's known blob hashes (data.getSha256BlobHashes(), or the main artifact) to compare against the supplied checksum. If the file name does not correspond to any blob recorded for that pack, it throws HTTP 400 'Unknown file to verify checksum'.

Source

Thrown at server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java:374

						if (sha256BlobHash != null) {
							PackBlob packBlob;
							if ((packBlob = packBlobService.checkPackBlob(projectId, sha256BlobHash)) != null) {
								String blobHash;
								if (fileName.endsWith(EXT_SHA256))
									blobHash = sha256BlobHash;
								else
									blobHash = getNonSha256Hash(packBlob, fileName);
								if (blobHash.equals(checksum)) {
									packBlobReferenceService.createIfNotExist(pack, packBlob);
									response.setStatus(SC_OK);
								} else {
									throw new HttpResponseAwareException(SC_BAD_REQUEST, "Checksum verification failed");
								}
							} else {
								throw new HttpResponseAwareException(SC_BAD_REQUEST);
							}
						} else {
							throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown file to verify checksum");
						}
					} else {
						throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown GAV to verify checksum");
					}
				}));			
			} else {
				var packBlobId = packBlobService.uploadBlob(projectId, is, null);
				var sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());
				LockUtils.run(lockName, () -> transactionService.run(() -> {
					var project = projectService.load(projectId);
					Pack pack = findPack(project, groupId, artifactId, version);
					if (pack == null) {
						pack = new Pack();
						pack.setProject(project);
						pack.setType(TYPE);
						pack.setName(getName(groupId, artifactId));
						pack.setVersion(version != null? version: NONE);
						pack.setPrerelease(version != null && version.endsWith(VERSION_SUFFIX_SNAPSHOT));

View on GitHub (pinned to d44925c47c)

Solutions

1. Upload the artifact itself first, then its checksum file — checksums can only verify already-stored blobs.
2. Confirm the checksum file name exactly matches the artifact file name already present in the pack.
3. Verify you are uploading to the same groupId/artifactId/version the artifact was uploaded under.

Example fix

// before — checksum for unuploaded file
curl -T lib-1.0.jar.md5 "$URL/.../lib-2.0.jar.md5"
// after — upload artifact then matching checksum
curl -T lib-1.0.jar "$URL/.../lib-1.0.jar"
curl -T lib-1.0.jar.md5 "$URL/.../lib-1.0.jar.md5"

# Ensure each checksum upload has its artifact already deployed
for cs in target/*.sha1 target/*.md5; do
  art="${cs%.*}"
  [ -f "target/deployed/$(basename "$art")" ] || { echo "artifact $art not deployed yet"; exit 1; }
done

When it happens

Trigger: A client uploads a checksum file (.sha1/.md5/.sha256) for a file name that has never been uploaded to that GAV — e.g. checksum arrives before its artifact, the artifact name is misspelled, or the checksum targets a file belonging to a different version.

Common situations: Out-of-order uploads where a retried checksum upload lands after the artifact was cleaned; typo'd artifact file name; uploading checksums for artifacts managed by a different pack (release vs snapshot).

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Checksum exceeds maximum size: ${MAX_CHECKSUM_LEN}
• Checksum verification failed
• Unknown GAV to verify checksum
• Unknown GAV
• No package write permission for project: ${project.getPath()

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a8283c66474fd741. Report an issue: GitHub.