Checksums

Generate cryptographic checksums for all artifacts

The checksum stage computes cryptographic hashes for all artifacts and writes them to a checksum file.

Classification

Packager — generates a checksum file alongside release artifacts. Required: not a publisher; always runs unless disabled.

Minimal config

Checksums are enabled by default with SHA-256. No config needed for basic usage.

Full config reference

defaults:
  checksum:
    name_template: "{{ ProjectName }}_{{ Version }}_checksums.txt"  # optional
    algorithm: sha256                   # optional; sha256 | sha512 | sha1 | blake2b | etc.
    skip: false                         # optional; skip checksum generation
    extra_files: []                     # optional; additional files to checksum
    ids: []                             # optional; only checksum artifacts matching these IDs
    split: false                        # optional; one sidecar per artifact instead of a combined file
    split_format: bare                  # optional; bare | coreutils (only when split: true)

When split: true, anodizer writes one sidecar per artifact (e.g. app-1.0.0-linux-amd64.tar.gz.sha256) instead of a combined checksums.txt. The sidecar content is controlled by split_format:

• bare (default) — the raw hex hash only, no filename, no trailing newline (matches GoReleaser's split-checksum output).
• coreutils — <hash> <filename> with a trailing newline, so each sidecar verifies directly with shasum -c / sha256sum -c from the artifact directory. Choose this when migrating from a hand-rolled shasum -a 256 file > file.sha256 step whose consumers run shasum -c.

The combined (split: false) file is always coreutils-format.

Authentication

Not applicable — checksum generation is a local build step with no external service calls.

Common gotchas

• The checksum file aggregates hashes for all artifacts produced up to this stage. Signing runs after checksums in the fixed pipeline order (checksum → attest → sign → release), so signature files are never listed inside the checksum file — they are themselves separate release assets. This ordering is not configurable.
• extra_files adds files to the checksum file without uploading them; ensure they exist at the path specified.

Republish / update behavior

Not applicable — this is a local packaging stage, not a publisher.

Checksum config fields

Supported algorithms

Custom config

defaults:
  checksum:
    name_template: "{{ ProjectName }}_{{ Version }}_SHA512SUMS"
    algorithm: sha512

Disabling checksums

defaults:
  checksum:
    skip: true