ChecksumPolicy

ChecksumPolicy is a configuration option used by software systems to govern how cryptographic checksums are handled when downloading, caching, or validating artifacts. The policy defines whether checksums are validated, what to do if a checksum is missing or incorrect, and which checksum algorithms are considered acceptable. The goal is to protect against tampering and data corruption while balancing performance and availability.

Common values include: fail or enforce (abort on a mismatch or absence of a valid checksum), warn (log a warning but proceed), and ignore (do not perform checksum validation). Some systems distinguish between missing checksums and mismatches, offering separate behavior for each case. The exact set of options and their semantics vary by tool or platform.

Scope and application: ChecksumPolicy can be configured globally or per repository, per artifact, or per download. It may be exposed in build configurations, artifact repositories, or transport adapters. Policy often interacts with the selected checksum algorithms, such as SHA-256, SHA-1, or MD5, with a preference for stronger algorithms.

Security and best practices: Verifying checksums helps detect corruption and tampering; avoid weak algorithms like MD5; ensure checksum data is delivered through trusted channels and is signed when possible. If a system supports it, prefer strict policies that fail on mismatch to prevent compromised downloads, while dev or test environments may use more permissive settings for convenience.

See also: checksum, hash, accidental corruption, reproducible builds.