Search code examples
scalasbtartifactory

How do I publish artifacts with checksums (MD5, SHA1)?

I would like sbt publish to publish my JARs with some checksum however I can't seem to be able to achieve that.

The documentation says that checksums are enabled by default and I can confirm that checksums returns me md5 and sha1 in sbt. I can also see the generated checksums if I do sbt publishLocal. However there are no checksums when I do sbt publish on our CI server when publishing JARs to our company Artifactory server.

What am I missing?

More info:

  • sbt 1.4.6
  • publishMavenStyle := true
  • publishTo := <internal Artifactory>
  • I would say it's specific to my company's Artifactory because publishLocal works well.
  • publish / checksums returns the same thing as just checksums which is a list of md5 and sha1 values (the only two values that are supported by sbt as far as I could find).
  • I've tried to turn off Coursier (just a hunch) and it behaved the same.

I've tried the debug log level and this is what is at the end of the build:

  [debug] Done packaging.
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.pom
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.pom
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.jar
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.jar
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28-sources.jar
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28-sources.jar
20:27:44
  [success] Total time: 0 s, completed Jan 28, 2021, 7:27:44 PM
Solution

  • The issue here is JFrog, and not SBT.

    For example, we can see that play-json has no checksums mentions in its build.sbt, nor anywhere else in their repository. Yet, looking at their published artifacts at maven, I see there both sha-1, and md5 artifacts.

    When browsing a bit, I found this:

    How to show the checksum files when browsing artifacts from the direct URL?

    Which makes me to think that JFrog hides it. The resolution there is:

    Simply set a property in the $ARTIFACTORY_HOME/etc/artifactory.system.properties file.

    1. Add the following property to the artifactory.system.properties file and save lit: artifactory.ui.hideChecksums=false

    2. Restart Artifactory for the change to take effect:

    I must admit I didn't try it, but it is probably a lead.