scala - How do I publish artifacts with checksums (MD5, SHA1)?

Question

I would like sbt publish to publish my JARs with some checksum however I can't seem to be able to achieve that.

The documentation says that checksums are enabled by default and I can confirm that checksums returns me md5 and sha1 in sbt. I can also see the generated checksums if I do sbt publishLocal. However there are no checksums when I do sbt publish on our CI server when publishing JARs to our company Artifactory server.

What am I missing?

More info:

• sbt 1.4.6
• publishMavenStyle := true
• publishTo := <internal Artifactory>
• I would say it's specific to my company's Artifactory because publishLocal works well.
• publish / checksums returns the same thing as just checksums which is a list of md5 and sha1 values (the only two values that are supported by sbt as far as I could find).
• I've tried to turn off Coursier (just a hunch) and it behaved the same.

I've tried the debug log level and this is what is at the end of the build:

  [debug] Done packaging.
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.pom
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.pom
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.jar
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28.jar
20:27:44
  [debug] CLIENT ERROR: Not Found url=https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28-sources.jar
20:27:44
  [info]   published ip-info_2.13 to https://<artifactory>/artifactory/maven-local/com/avast/ip-info_2.13/2.8.28/ip-info_2.13-2.8.28-sources.jar
20:27:44
  [success] Total time: 0 s, completed Jan 28, 2021, 7:27:44 PM

question from:https://stackoverflow.com/questions/65940936/how-do-i-publish-artifacts-with-checksums-md5-sha1

Answer 1

I think I figured it out. The issue here is jfrog, and not sbt.

For example, we can see that play-json has no checksums mentions in its build.sbt, nor anywhere else in their repository. Yet, looking at their published artifacts at maven, I see there both sha-1, and md5 artifacts.

When browsing a bit, I found this:

How to show the checksum files when browsing artifacts from the direct URL?

Which makes me to think that JFrog hides it. The resolution there is:

Simply set a property in the $ARTIFACTORY_HOME/etc/artifactory.system.properties file.

1. Add the following property to the artifactory.system.properties file and save lit: artifactory.ui.hideChecksums=false

2. Restart Artifactory for the change to take effect:

I must admit I didn't try it, but it is probably a lead.