Upload checksum along with rpm to Artifactory - Mon, May 23, 2022
Upload checksum along with rpm to Artifactory
While working on the CI/CD process in my current process, I noticed that all RPMs uploaded with curl to Artifactory had their checksum missing indicated by the following warning in the GUI:
Client did not publish a checksum value. If you trust the uploaded artifact you can accept the actual checksum by clicking the 'Fix Checksum' button.
The manual fix was of course to just click the above mentioned button. But since the checksum should be uploaded with the RPM itself, I searched for a way to do that. After doing some research I found out that Artifactory provides the header X-Checksum-Sha1
for uploading the checksum.
So all I needed to add was calculating the checksum and setting the appropriate header:
$ export SHA1=$(sha1sum -b test.rpm | cut -d ' ' -f 1)
$ curl -H "X-JFrog-Art-Api: mySuperSecretToken" -T test.rpm -H "X-Checksum-Sha1:$SHA1" "https://artifactory.com/artifactory/my-rpm-repo/test.rpm" -i
The sha1sum
command comes with most linux distributions. The cut
at the end cuts of the name of the rpm which is usually appended to the output. In the second line the calculated sha is uploaded using the header Checksum-Sha1.