Fast-path Maven checksum uploads behind a feature flag

Moaz Khalifarequested to merge
605713-package-registry-skip-find-or-create-for-maven-checksum-sha1-md5-uploads into master

What does this MR do and why?

During mvn deploy, Maven uploads a .sha1 and .md5 checksum file after every artifact (.jar, .pom, maven-metadata.xml). On the package finalize endpoint (PUT /projects/:id/packages/maven/*path/:file_name), these checksum uploads ran the full Packages::Maven::FindOrCreatePackageService path — duplicate detection, a cascading namespace-setting lookup, create_build_infos!, and (on create) a protection-rule check plus INSERTs — even though checksums are stored as columns on the package file and never need find-or-create. For a release deploy that is roughly two-thirds of the PUTs per module (~6 of ~9) doing avoidable work on a hot, latency-sensitive endpoint.

This MR fast-paths checksum uploads:

  • md5 → returns an empty body immediately (no DB work, no primary pinning);
  • sha1 → looks up the package and package file and verifies the stored hash, skipping find-or-create.

The real-artifact path is untouched, and the happy path (artifact uploaded before its checksums, as Maven and Gradle always do) is behaviorally identical.

Feature flag

Gated behind maven_checksum_upload_fast_path (gitlab_com_derisk, default off). When disabled, the endpoint behaves exactly as before — the original method body is preserved verbatim.

How to validate

With the flag enabled, publish a Maven package (or upload a .jar followed by its .jar.sha1 / .jar.md5) and confirm the checksum PUTs still return 204 / empty 200 and no longer instantiate FindOrCreatePackageService.

Database

No new query shapes are introduced. The sha1 fast path calls the existing Packages::Maven::PackageFinder and Packages::PackageFileFinder, both of which already run on this endpoint today — PackageFinder via FindOrCreatePackageService and PackageFileFinder in the flag-off sha1 branch. The change removes queries for checksum uploads (find-or-create, duplicate detection, build-info writes) rather than adding any, and md5 runs no queries at all. No database review is required.

Testing

  • spec/requests/api/maven_packages_spec.rb — checksum contexts assert the fast path skips find-or-create (flag on) and that the original path still works (flag off).
  • spec/features/file_uploads/maven_package_spec.rb — .sha1 / .md5 upload paths.

References

Closes #605713

Edited by Moaz Khalifa

Merge request reports