Fix checksum in Artifactory when uploading file through REST API

Question

I\'m using the code below to upload a file through Artifactory\'s REST API. My problem is that when I view the file through the GUI I get this message:

Answer 1

I am hitting the same issue using the artifactory-client-java library :-(

So after some digging, it appears that you need to:

• calculate the checksums on the client side (sha1)
• provide each checksum as a HTTP header on the PUT request

For your C# example, the correct solution is to add a header "X-Checksum-Sha1" with the calculated checksum. As explained in the link documentation, a simple curl example is

curl -uadmin:password -T file.jar -H "X-Checksum-Sha1:c9a355147857198da3bdb3f24c4e90bd98a61e8b""http://localhost:8081/artifactory/libs-release-local/file.jar" -i

For artifactory-client-java users, the easy fix is to add to the documented upload example:

java.io.File file = new java.io.File("fileToUpload.txt");
File result = artifactory.repository("RepoName").upload("path/to/newName.txt", file).doUpload();

an additional intermediary call: bySha1Checksum():

java.io.File file = new java.io.File("fileToUpload.txt");
File result = artifactory.repository("RepoName").upload("path/to/newName.txt", file).bySha1Checksum().doUpload();

Answer 2

I was able to just use the sha1 header and artifactory stopped complaining, here's a bash snippet as example:

CHECKSUM=sha1sum some.rpm | awk '{ print $1 }' curl -k -umy_user:my_pass -H "X-Checksum-Sha1:$CHECKSUM" -XPUT https://cudgels_are_cool.com/artifactory/some_repo -T some.rpm

Answer 3

@Arnaud Jeansen's answer is good and true. I thought I would share my bash/curl script for deploying with checksums to provide additional details.

This is current as of Artifactory 6.2, and the date of this writing.

# assume test2.zip is the file to upload in current directory

# calculate checksums
sha256=$(openssl dgst -sha256 test2.zip|sed 's/^SHA256.*= //')
sha1=$(openssl dgst -sha1 test2.zip|sed 's/^SHA.*= //')

# upload to Artifactory
curl -u"${ARTIFACTORY_USER}:${ARTIFACTORY_PASSWORD}" \
 -sS -T test2.zip  \
 -H "X-Checksum-Sha256:${sha256}" -H "X-Checksum-Sha1:${sha1}" \
 "http://${ARTIFACTORY_HOST}:8081/artifactory/REPO/path/test2.zip" \
 > response

 jq '.' < response
 echo ''

The resultant artifact does not display the warning about checksums in the UI.