Checksums

Generate cryptographic checksums for all artifacts

The checksum stage computes cryptographic hashes for all artifacts and writes them to a checksum file.

Classification

Packager — generates a checksum file alongside release artifacts. Required: not a publisher; always runs unless disabled.

Minimal config

Checksums are enabled by default with SHA-256. No config needed for basic usage.

Full config reference

defaults:
  checksum:
    name_template: "{{ ProjectName }}_{{ Version }}_checksums.txt"  # optional
    algorithm: sha256                   # optional; sha256 | sha512 | sha1 | blake2b | etc.
    skip: false                         # optional; skip checksum generation
    extra_files: []                     # optional; additional files to checksum
    ids: []                             # optional; only checksum artifacts matching these IDs

Authentication

Not applicable — checksum generation is a local build step with no external service calls.

Common gotchas

• The checksum file aggregates hashes for all artifacts produced up to this stage. Signing runs after checksums in the fixed pipeline order (checksum → attest → sign → release), so signature files are never listed inside the checksum file — they are themselves separate release assets. This ordering is not configurable.
• extra_files adds files to the checksum file without uploading them; ensure they exist at the path specified.

Republish / update behavior

Not applicable — this is a local packaging stage, not a publisher.

Checksum config fields

Supported algorithms

Custom config

defaults:
  checksum:
    name_template: "{{ ProjectName }}_{{ Version }}_SHA512SUMS"
    algorithm: sha512

Disabling checksums

defaults:
  checksum:
    skip: true