Don't require checksums for signature files

Fixes #859.
clojars · Apr 12, 2023 · 562c798 · 562c798
1 parent 2d80037
commit 562c798
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/src/clojars/file_utils.clj b/src/clojars/file_utils.clj
@@ -37,9 +37,9 @@
   ([file type]
    (valid-checksum-file? file type true))
   ([file type fail-if-missing?]
-   (let [sig-file (checksum-file file type)]
-     (if (.exists sig-file)
-       (valid-checksum? (slurp sig-file) file type)
+   (let [sum-file (checksum-file file type)]
+     (if (.exists sum-file)
+       (valid-checksum? (slurp sum-file) file type)
        (not fail-if-missing?)))))
 
 (defn group->path [group]

diff --git a/src/clojars/routes/repo.clj b/src/clojars/routes/repo.clj
@@ -258,8 +258,11 @@
 (defn validate-checksums [artifacts]
   (doseq [f artifacts]
     ;; verify that at least one type of checksum file exists
-    (when (not (or (.exists (fu/checksum-file f :md5))
-                   (.exists (fu/checksum-file f :sha1))))
+    (when (and (not (or (.exists (fu/checksum-file f :md5))
+                        (.exists (fu/checksum-file f :sha1))))
+               ;; Aether by default no longer checksums signature files, so we don't
+               ;; throw if it is missing
+               (not (match-file-name #"\.asc$" f)))
       (throw-invalid :file-missing-checksum
                      (format "no checksums provided for %s" (.getName f))
                      {:file f}))