theonedev/onedev · error · HttpResponseAwareException

Unknown GAV to verify checksum

Error message

Unknown GAV to verify checksum

What it means

During checksum verification in uploadBlob, after the file name is recognized, the pack itself is looked up via findPack(project, groupId, artifactId, version). If no pack exists for the supplied GAV, the handler throws HTTP 400 'Unknown GAV to verify checksum' — a checksum cannot be attached to a package that does not exist.

Source

Thrown at server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java:377

								String blobHash;
								if (fileName.endsWith(EXT_SHA256))
									blobHash = sha256BlobHash;
								else
									blobHash = getNonSha256Hash(packBlob, fileName);
								if (blobHash.equals(checksum)) {
									packBlobReferenceService.createIfNotExist(pack, packBlob);
									response.setStatus(SC_OK);
								} else {
									throw new HttpResponseAwareException(SC_BAD_REQUEST, "Checksum verification failed");
								}
							} else {
								throw new HttpResponseAwareException(SC_BAD_REQUEST);
							}
						} else {
							throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown file to verify checksum");
						}
					} else {
						throw new HttpResponseAwareException(SC_BAD_REQUEST, "Unknown GAV to verify checksum");
					}
				}));			
			} else {
				var packBlobId = packBlobService.uploadBlob(projectId, is, null);
				var sha256BlobHash = sessionService.call(() -> packBlobService.load(packBlobId).getSha256Hash());
				LockUtils.run(lockName, () -> transactionService.run(() -> {
					var project = projectService.load(projectId);
					Pack pack = findPack(project, groupId, artifactId, version);
					if (pack == null) {
						pack = new Pack();
						pack.setProject(project);
						pack.setType(TYPE);
						pack.setName(getName(groupId, artifactId));
						pack.setVersion(version != null? version: NONE);
						pack.setPrerelease(version != null && version.endsWith(VERSION_SUFFIX_SNAPSHOT));
						pack.setData(new MavenData());
					}
					

View on GitHub (pinned to d44925c47c)

Solutions

1. Publish the artifact (the full jar/pom) for that GAV first, then upload checksums.
2. Check the repository URL path segments — groupId is derived from directory segments, artifactId is the last file's base name; fix typos.
3. Verify the version in the URL matches the deployed version exactly (e.g. 1.0.0 vs 1.0.0-SNAPSHOT).

Example fix

// before
curl -T app-1.0.jar.sha1 "$URL/com/acme/app/1.0.1/app-1.0.1.jar.sha1"  # 1.0.1 never deployed
// after
curl -T app-1.0.jar "$URL/com/acme/app/1.0.0/app-1.0.0.jar"
curl -T app-1.0.jar.sha1 "$URL/com/acme/app/1.0.0/app-1.0.0.jar.sha1"

# Before uploading checksums, confirm the GAV exists in the project
GAV_PATH="com/acme/app/1.0.0"
STATUS=$(curl -s -o /dev/null -w '%{http_code}' -u "$USER:$TOKEN" "$BASE/~maven/1/$GAV_PATH/app-1.0.0.pom")
[ "$STATUS" = "200" ] || { echo "GAV not published (HTTP $STATUS); deploy artifact first"; exit 1; }

When it happens

Trigger: A client uploads a .sha1/.md5/.sha256 file for a groupId/artifactId/version combination that was never published to the project (artifact upload skipped/failed, or coordinates in the URL are wrong).

Common situations: Deploy failed midway leaving only checksum uploads; typo in repository path coordinates; uploading checksums against a project that never received the artifact; release version vs snapshot mix-up in the URL.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Checksum exceeds maximum size: ${MAX_CHECKSUM_LEN}
• Checksum verification failed
• Unknown file to verify checksum
• No package write permission for project: ${project.getPath()
• Upload must be less than

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/e95d3dfbeafbd202. Report an issue: GitHub.