SHA-256 Support

JFrog Installation & Setup Documentation

Content Type
Installation & Setup

Artifactory natively supports SHA-256 since Artifactory version 5.5. An artifact's SHA-256 checksum is calculated when it is deployed to Artifactory, and is maintained in persistent storage as part of the database. The Set Item SHA256 Checksum REST API endpoint (which sets an artifact's SHA-256 checksum as one of its properties) is still supported for backward compatibility, however, this endpoint will eventually be deprecated.Set Item SHA256 Checksum

Artifactory's support for SHA-256 checksums is fully-featured and is evident in several ways.

  • They can be used in AQL queries, and are returned in corresponding responses

  • They are included as download header information

  • They can be used in the Deploy Artifact and Deploy Artifact by Checksum REST API endpoints.

  • They are included when downloading a folder

  • They are displayed in the General Information tab of the Artifact Repository Browser

  • The can be used in a variety of REST API endpoints used for search

Making full use of Artifactory's native support for SHA256

New artifacts that are uploaded will automatically have their SHA-256 checksum calculated, however, artifacts that were already hosted in Artifactory prior to the upgrade will not have their SHA-256 checksum in the database yet.

To make full use of Artifactory's SHA-256 capabilities, you need to Migrate the Database to Include SHA-256 making sure that the record for each artifact includes its SHA-256 checksum.