Checksums and signatures
Artifex serves every checksum that Maven and Gradle verify against, and it shows what a detached signature next to a file says about itself.
Checksums
Every file in a repository has MD5, SHA-1, SHA-256, and SHA-512 checksums, and so does every version list. Your build verifies what it downloads against them without any setup.
The checksums always match the file, whether or not your build uploaded a checksum when it deployed, and whichever algorithms it uploaded. A checksum that your build uploads is compared with the file, and a deploy whose file was corrupted on the way fails rather than being recorded.
When a file arrives from a remote upstream, Artifex also compares it with the checksums that the upstream publishes, and keeps the file only when they agree. The file page shows which algorithms were verified this way.
Signatures
A detached OpenPGP signature is deployed as a file next to what it signs, with .asc added to the name:
com/example/hello/1.0.0/hello-1.0.0.jar
com/example/hello/1.0.0/hello-1.0.0.jar.ascMaven's GPG plugin and Gradle's signing plugin produce these files, and Artifex accepts them like any other file. Both are deployed and both are served, so a consumer can verify the jar against the signature with their own tools and their own copy of your public key.
A version page marks the files that have a signature next to them.
The file page of a .asc file shows what the signature says about itself:
| Field | What it is |
|---|---|
| Key ID | The key that made the signature |
| Fingerprint | The key's fingerprint, when the signature carries it |
| Created | When the signature was made |
| Hash algorithm | The digest algorithm that was signed |
| Public key algorithm | The algorithm of the signing key |
Artifex doesn't hold your public keys and doesn't check the signature against the artifact; verification is done by whoever trusts the key. Treat the fields as a way to see which key signed a release, not as proof that the signature is good.
Advanced
A checksum is served at the file's path with .md5, .sha1, .sha256, or .sha512 added. The response is the hex digest followed by a newline, as text/plain.
When a client uploads a checksum during a deploy, a digest that matches answers 201 Created and isn't stored; the file is the source of the digest. A digest that doesn't match, or a body that isn't a hex digest, answers 400 Bad Request and names the value Artifex computed. A checksum for a file that isn't there answers 404 Not Found. A checksum file may carry a file name after the digest, which is what some tools write.
An upstream file whose published checksum doesn't match the bytes that arrived isn't kept, and the request answers 503 Service Unavailable.