Issue #8571

Updated by daviddavis 4 months ago

Steps to reproduce:

1. Enable md5 via ALLOWED_CONTENT_CHECKSUMS and sync down an md5 repository (eg
2. Disable md5 and run pulpcore-manager handle-artifact-checksums
3. Now create a publication for your repository version using an allowed checksum:

http :/pulp/api/v3/publications/rpm/rpm/ repository_version=/pulp/api/v3/repositories/rpm/rpm/a1263205-e97a-452f-a674-f516714812c6/versions/1/ package_checksum_type="sha256"

You'll get this error:

ValueError: Package camel-0:0.1-1.noarch as content unit 6d518294-c03c-4cf1-b8ef-0e663b73274a contains forbidden checksum type 'md5', thus can't be published. Checksum must be one of the allowed checksum types.

I believe [this check]( ) is faulty since it solely checks `rpm_package.checksum_type` and doesn't consider `package_checksum_type`. even though the package might have several checksum types it could be published with,