如何通过 curl 使用他们的 rest api 从 Nexus 检索工件校验和？

Question

I am trying to verify the checksum of the artifacts I am downloading from Nexus. I can grab the artifact and download them and check their md5sum or sha1sum, but I need to check this against the actual sum from Nexus so I can verify they are correct.

This is the command I'm using to grab files from Nexus:

curl -v -L -o /mylocation/artifact.war -u 'myuser:mypass' --get 'http://ournexus.com/service/local/artifact/maven/content?g=com.ours.stuff&a=our-service-war&v=LATEST&r=snapshots&p=war'

Via http://nexus.xwiki.org/nexus/nexus-indexer-lucene-plugin/default/docs/path__lucene_search.html , it would appear that I can also search for the sha1 sum, but when I do &sha1 I get nothing extra or sha1=(sum), nothing is pulled up, even if I omit all the above options.

This works, but it goes to a specific war, and we need the latest (obviously):

http://ournexus.com/service/local/repositories/snapshots/content/com/ours/stuff/ourapp/1.0.0-SNAPSHOT/ourapp-1.0.0-20140730.173704-88.war.sha1

Is this possible, am I on the right track?

Answer 1

You can either fetch the file directly or use the Nexus API to retrieve it programmatically.

The following URL:

http://localhost:8081/nexus/service/local/artifact/maven/resolve?g=log4j&a=log4j&v=1.2.9&r=central

Returns the following result:

<artifact-resolution>
  <data>
    <presentLocally>true</presentLocally>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.9</version>
    <extension>jar</extension>
    <snapshot>false</snapshot>
    <snapshotBuildNumber>0</snapshotBuildNumber>
    <snapshotTimeStamp>0</snapshotTimeStamp>
    <sha1>55856d711ab8b88f8c7b04fd85ff1643ffbfde7c</sha1>
    <repositoryPath>/log4j/log4j/1.2.9/log4j-1.2.9.jar</repositoryPath>
  </data>
</artifact-resolution>

The xmllint command can be used to parse out the sha1 checksum value as follows:

$ curl -s "http://localhost:8081/nexus/service/local/artifact/maven/resolve?g=log4j&a=log4j&v=1.2.9&r=central" | xmllint --xpath "///sha1/text()" -
55856d711ab8b88f8c7b04fd85ff1643ffbfde7c

Answer 2

Nexus 2

Use the artifact content API to directly get the MD5/SHA1 checksum file by specifying the p (packaging) or e (extension) parameter as jar.md5 or jar.sha1 (or other relevant for your actual packaging).

Example:

$ curl -s 'http://mynexus/service/local/artifact/maven/content?g=com.example&a=example&v=1.2.3&r=my-repo&e=jar.sha1'
55856d711ab8b88f8c7b04fd85ff1643ffbfde7c

Nexus 3

Use the Search API to find and download the asset.

$ curl -sL 'https://mynexus/service/rest/v1/search/assets/download?repository=my-repo&sort=version&maven.groupId=com.example&maven.artifactId=example&maven.baseVersion=LATEST-SNAPSHOT&maven.extension=jar.sha1&maven.classifier='
7ff1ca9fb889c73d095b69a52d5c8609482b63ab

Answer 3

The query below works for me

curl -u USER:PASS -X GET 'https://nexus.example.com:8443/service/rest/v1/search?repository=REPO_NAME&name=FILE_NAME' | jq '.items[0].assets[0].checksum'

Always good to check the API doc .

ps: username and password might be not needed for GET