How does the maven repository checksum work?

2
votes

How does the checksum generation work when publishing artifacts to maven repository (using mvn deploy plugin or gradle maven-publish plugin)? Is it the plugin or the remote repository host that generates the checksum?

If the remote repository generates the checksum, how to verify that the artifact was uploaded "safely" to the remote repository?

1
mavengradle

1 Answers

1
votes

I can't tell you something about how Gradle Plugin works but I can tell you how it works for Maven.

  • maven-deploy-plugin/maven-install-plugin version 2.X

    • The install plugin generates the artifact checksums (SHA1, MD5)
    • The deploy plugin only deploys (transfers not 100% accurate not relevant here) to the remote repository.

  • maven-deploy-plugin/maven-install-plugin version 3.X

    • The deploy plugin generates the artifact checksums (SHA1, MD5) afterwards those artifacts are transfered (see above) to the remote repository.

This means the checksums are generated during the build process (on the local machine whoever this is) and not on the server machine (remote repository host).

The verification should be turned on via settings.xml (checksumPolicy)