{"version":"2.1.271","anchor":"artifact-publishupload-now-re-verifies-file-content-against","canonical_anchor":"artifact-publishupload-now-re-verifies-file-content-against","heading":"Asset upload\/publish re-verifies file content against its admitted hash","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/artifact-publishupload-now-re-verifies-file-content-against","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### Asset upload\/publish re-verifies file content against its admitted hash\n\nUploading or publishing an artifact now checks the file's bytes against a previously recorded sha256 hash instead of trusting a fresh read\n\n**What**\n\nWhen uploading or publishing artifact files, Claude Code now checks the on-disk bytes against a sha256 hash (`publishSourceSha256` \/ `publishFilesSha256`) that was recorded earlier when the content was approved, instead of just re-reading the file fresh each time.\n\n- If this hash is already known for the call, the tool skips its usual local validation steps (size limits, empty-file checks, not-a-file checks, etc.) for the `upload_asset` action.\n\n- If the file's current content no longer matches the recorded hash, the call now fails with an error explaining that the file couldn't be verified as the one that was originally admitted, instead of silently uploading or publishing the changed bytes.\n\n**Why**\n\nThis prevents a file from being swapped out between the time its content was approved and the time it's actually uploaded or published, so what gets published is guaranteed to be the exact content that was checked.\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}