Checksum-on-upload, explained simply
The problem. You send a file. Somewhere on the way a bit flips, or your script grabbed the wrong file. The server can't tell — it just stores whatever arrived.
The fix. You also send a short fingerprint of the file (its checksum). The server makes its own fingerprint of what it received and compares. Same → keep it. Different → throw it away and say "400, checksum mismatch".
Analogy. You mail a parcel and also text the recipient a photo of what's inside. They open the box and compare. If the box was tampered with or the wrong thing was packed, they refuse it instead of shelving a broken parcel.
How you send the fingerprint. One extra header on your upload:
X-Checksum-Sha256: <the sha256 of your file>Get that number with sha256sum yourfile.
Do I have to? No. If you don't send the header, uploads work exactly like before. It's a seatbelt you can choose to click in.
Why not sha1 or md5? Those old fingerprints are easy to fake, so Holger ignores them. Use sha256 (or sha512).