diff --git a/src/main/python/ddadevops/application/release_mixin_services.py b/src/main/python/ddadevops/application/release_mixin_services.py
index 546d93e..8dccb2d 100644
--- a/src/main/python/ddadevops/application/release_mixin_services.py
+++ b/src/main/python/ddadevops/application/release_mixin_services.py
@@ -69,11 +69,29 @@ class ReleaseService:
                 release.release_artifact_token,
             )
         )
+
+        artifacts_to_attach = []
         for artifact_path in release.release_artifacts:
             self.artifact_deployment_api.calculate_checksums(artifact_path)
+            # TODO: make api more explizit to have the path calculation & decision which shas to take clear
+            artifacts_to_attach += [{
+                "path": artifact_path,
+                # TODO: it will not always be a jar file -> move type to release input-side.
+                "type": "application/x-java-archive",
+            },
+            {
+                "path": f"{artifact_path}.sha256",
+                "type": "text/plain",
+            },
+            {
+                "path": f"{artifact_path}.sha512",
+                "type": "text/plain",
+            }]
+
+        # TODO: use structure created above
+        for artifact in artifacts_to_attach:
             self.artifact_deployment_api.add_asset_to_release(
-                "todo",
-                release_id,
+                release.forgejo_release_asset_api_endpoint(release_id),
                 "todo",
                 "todo",
                 release.release_artifact_token,
diff --git a/src/main/python/ddadevops/infrastructure/infrastructure.py b/src/main/python/ddadevops/infrastructure/infrastructure.py
index d86e029..9708cc6 100644
--- a/src/main/python/ddadevops/infrastructure/infrastructure.py
+++ b/src/main/python/ddadevops/infrastructure/infrastructure.py
@@ -231,18 +231,17 @@ class ArtifactDeploymentApi:
 
     def add_asset_to_release(
         self,
-        target_url: str,
-        release_id: str,
+        api_endpoint_url: str,
         attachment: str,
         attachment_type: str,
         token: str,
     ):
         return self.execution_api.execute_secure(
-            f'curl -X "POST" "{target_url}/{release_id}/assets" '  # {target_url}/{release_id}/assets move to Domain
+            f'curl -X "POST" "{api_endpoint_url}" '
             + f'-H "accept: application/json" -H "Authorization: token {token}" '
             + '-H "Content-Type: multipart/form-data" '
             + f'-F "attachment=@{attachment};type={attachment_type}"',
-            sanitized_command=f'curl -X "POST" "{target_url}/{release_id}/assets" '  # see above
+            sanitized_command=f'curl -X "POST" "{api_endpoint_url}" '
             + '-H "accept: application/json" '
             + '-H "Content-Type: multipart/form-data" '
             + f'-F "attachment=@{attachment};type={attachment_type}"',