<!-- nornir:class: guide -->
# Verifying an upload with `X-Checksum-*`
Holger can check that the bytes it received are exactly the bytes you meant to send.
Compute the digest of your file and pass it as a header on the upload; Holger
recomputes it and rejects the request if they differ.
## Do it
```bash
# 1. digest your artifact
SUM=$(sha256sum my-crate-1.0.0.crate | cut -d' ' -f1)
# 2. upload with the checksum header
curl -sS -X PUT \
-H "Authorization: Bearer $TOKEN" \
-H "X-Checksum-Sha256: $SUM" \
--data-binary @my-crate-1.0.0.crate \
https://holger.internal/my-repo/…
```
- Match → the upload proceeds normally.
- Mismatch (corruption in transit, wrong file) → **HTTP 400 `sha256 checksum
mismatch`**, and nothing is stored.
`X-Checksum-Sha512` works the same way; send both to check both. The header is
optional — omit it and the upload behaves as it always did.
## Notes
- Digests are hex, case doesn't matter.
- Only `sha256`/`sha512` are honoured. `sha1`/`md5` are refused on purpose — they're
too weak to prove integrity.
- Every rejected upload is written to the audit log, so a flapping CI job that keeps
sending corrupt bytes is visible.
- This is the HTTP native-protocol path (cargo/pip/npm/docker). The holger-native
gRPC upload does not yet carry a checksum field.