Skip to content

[BUG] Incorrect Hash Verification in BUCK Upload API #1922

Description

@jjl9807

While testing the BUCK upload API, I encountered the following error:

Buck API error: Hash mismatch: expected 3873e6d99a2a6e71f404f903e6867e49272ff987, got 5349b3b7fb470ed14e192cfab5a399f9f1ddc464

After investigation, I found that the API incorrectly implements hash verification logic by using the Git blob ID as the actual content hash:

https://github.com/web3infra-foundation/mega/blob/3efbf3b4f70c4dca1851820ae1f6cc5ff0bcae9d/jupiter/src/service/buck_service.rs#L760-L785

This is erroneous because Git computes the hash over a wrapped representation of the content, not the raw bytes themselves. Specifically, Git prepends the following header before hashing:

<type> <size>\0<content>

Only <content> corresponds to the original uploaded data. Therefore, the hash being verified is not that of the raw content.

This behavior is confirmed by the following commands:

$ sha1sum third-party/rust/crates/errno/0.3.14/BUCK
3873e6d99a2a6e71f404f903e6867e49272ff987  third-party/rust/crates/errno/0.3.14/BUCK

$ git hash-object -w third-party/rust/crates/errno/0.3.14/BUCK
5349b3b7fb470ed14e192cfab5a399f9f1ddc464

The API should compute and verify the SHA-1 hash over the raw content directly, rather than relying on Git's internal blob hash format.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions