nordisk/holger

Verifying an upload with X-Checksum-*

Holger can check that the bytes it received are exactly the bytes you meant to send. Compute the digest of your file and pass it as a header on the upload; Holger recomputes it and rejects the request if they differ.

Do it

# 1. digest your artifact
SUM=$(sha256sum my-crate-1.0.0.crate | cut -d' ' -f1)

# 2. upload with the checksum header
curl -sS -X PUT \
     -H "Authorization: Bearer $TOKEN" \
     -H "X-Checksum-Sha256: $SUM" \
     --data-binary @my-crate-1.0.0.crate \
     https://holger.internal/my-repo/…

• Match → the upload proceeds normally.
• Mismatch (corruption in transit, wrong file) → HTTP 400 sha256 checksum mismatch, and nothing is stored.

X-Checksum-Sha512 works the same way; send both to check both. The header is optional — omit it and the upload behaves as it always did.

Notes

• Digests are hex, case doesn't matter.
• Only sha256/sha512 are honoured. sha1/md5 are refused on purpose — they're too weak to prove integrity.
• Every rejected upload is written to the audit log, so a flapping CI job that keeps sending corrupt bytes is visible.
• This is the HTTP native-protocol path (cargo/pip/npm/docker). The holger-native gRPC upload does not yet carry a checksum field.