RiotGames/artifact-cookbook — pull request #70 by KAllan357 (2013-05-28 22:24:23+00:00)
Title: Nexus Downloads should automatically ask the Nexus server for their checksum

Had a report of a corrupted download from Nexus. Recently switched the logic for retrieving from Nexus to look like this:

```
def retrieve_from_nexus
remote_file cached_tar_path do
source Chef::Artifact.artifact_download_url_for(node, new_resource.artifact_location)
owner new_resource.owner
group new_resource.group
checksum new_resource.artifact_checksum
backup false
action :create
end
end
```

The problem is that when you have an `artifact_deploy` resource defined, you might not pass in the `artifact_checksum` attribute. If you do include that attribute, it becomes a maintenance burden because when you change the version of the artifact you want to deploy, you need to know the checksum so you can update that attribute.

I think this is especially a pain, because technically the Nexus *can* know the checksum of the artifact. I can see two options here:

1) When you retrieve from Nexus, you just ask the Nexus to automatically grab the checksum for the comparison:

`checksum Chef::Artifact.get_checksum_for(artifact_location)`

As long as this is a `remote_file` resource, we are bound by Chef's implementation of Checksum checking, which is SHA256. Nexus does not support SHA256 out of the box. I wrote a plugin for this, but its never been tested at scale - https://github.com/KAllan357/nexus-digests-plugin

2) Transition this artifact to two resources - the `remote_file` (without a checksum attribute) and then a `ruby_block` where we can compare the Nexus SHA1 (or md5) against our own call to get the digest in the equivalent format.

Thoughts?