添加链接
link之家
链接快照平台
  • 输入网页链接,自动生成快照
  • 标签化管理网页链接
Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

Why does Maven report "Checksum validation failed, no checksums available from the repository"?

Ask Question

I am trying to create a custom Maven repository using the 3 steps described here - http://www.javaworld.com/community/node/3968 . So, I followed all the steps and here I have the repository:

D:\maven2>dir /s/b
D:\maven2\com
D:\maven2\org
D:\maven2\web.config
D:\maven2\com\safenet
D:\maven2\com\safenet\hasp
D:\maven2\com\safenet\hasp\1
D:\maven2\com\safenet\hasp\maven-metadata.xml
D:\maven2\com\safenet\hasp\maven-metadata.xml.md5
D:\maven2\com\safenet\hasp\maven-metadata.xml.sha1
D:\maven2\com\safenet\hasp\1\hasp-1.jar
D:\maven2\com\safenet\hasp\1\hasp-1.pom
D:\maven2\com\safenet\hasp\1\_maven.repositories
D:\maven2\org\jnetpcap
D:\maven2\org\jnetpcap\jnetcap
D:\maven2\org\jnetpcap\jnetcap\1.3
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml.md5
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml.sha1
D:\maven2\org\jnetpcap\jnetcap\1.3\jnetcap-1.3.jar
D:\maven2\org\jnetpcap\jnetcap\1.3\jnetcap-1.3.pom
D:\maven2\org\jnetpcap\jnetcap\1.3\_maven.repositories
D:\maven2>type com\safenet\hasp\maven-metadata.xml
<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.safenet</groupId>
  <artifactId>hasp</artifactId>
  <versioning>
    <release>1</release>
    <versions>
      <version>1</version>
    </versions>
    <lastUpdated>20130108125547</lastUpdated>
  </versioning>
</metadata>
D:\maven2>type org\jnetpcap\jnetcap\maven-metadata.xml.md5
297455697088aad6bdbe256d48fb0676 *maven-metadata.xml
D:\maven2>type org\jnetpcap\jnetcap\maven-metadata.xml.sha1
f86d93727a76525f42f1b67997020e1a9a41b948 *maven-metadata.xml
D:\maven2>type org\jnetpcap\jnetcap\1.3\jnetcap-1.3.pom
<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.jnetpcap</groupId>
  <artifactId>jnetcap</artifactId>
  <version>1.3</version>
  <description>POM was created from install:install-file</description>
</project>
D:\maven2>

Now I am trying to use the hasp artifact in a pom file like this:

<dependency>
  <groupId>com.safenet</groupId>
  <artifactId>hasp</artifactId>
  <version>1</version>
  <scope>provided</scope>
</dependency>

And the repository is referenced like this:

<repository>
  <releases>
    <enabled>true</enabled>
    <updatePolicy>always</updatePolicy>
    <checksumPolicy>fail</checksumPolicy>
  </releases>
  <id>dev-builder</id>
  <name>Shunra private repository</name>
  <url>http://dev-builder/maven2</url>
  <layout>default</layout>
</repository>

Unfortunately, it does not work as expected:

[INFO] Building license 0.0.1
[INFO] ------------------------------------------------------------------------
Downloading: http://dev-builder/maven2/com/safenet/hasp/1/hasp-1.pom
[WARNING] The POM for com.safenet:hasp:jar:1 is missing, no dependency information available
Downloading: http://dev-builder/maven2/com/safenet/hasp/1/hasp-1.jar
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Local Driver Proxy ................................ SUCCESS [2.579s]
[INFO] Emulation API ..................................... SUCCESS [1.637s]
[INFO] util.logging ...................................... SUCCESS [1.023s]
[INFO] Infra ............................................. SUCCESS [0.250s]
[INFO] dtos .............................................. SUCCESS [0.691s]
[INFO] commons ........................................... SUCCESS [0.426s]
[INFO] license ........................................... FAILURE [2.195s]
[INFO] core .............................................. SKIPPED
[INFO] vcat .............................................. SKIPPED
[INFO] VCat-build ........................................ SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 9.044s
[INFO] Finished at: Tue Jan 15 21:27:43 EST 2013
[INFO] Final Memory: 6M/15M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project license: Could not resolve dependencies for project com.shunra:license:jar:0.0.1: Could not transfer artifact com.safenet:hasp:jar:1 from/to dev-builder (http
://dev-builder/maven2): Checksum validation failed, no checksums available from the repository -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :license
c:\dev\shunra\Application\Builder\build\vcat>

I have no idea what is the problem with it. The md5 and sha1 files were created using the cygwin port of the md5sum and sha1sum utilities. Still, Maven reports bad checksum.

I came here looking for the same answer. After spending hours trying to figure it out I finally found that the reason this is happening is two fold:

  • The checksums created by md5sum and shasum are not exactly what maven is looking for
  • You need checksums for all the files.
  • So basically that tutorial on javaworld.com is completely or at least partially wrong.

    So whats the answer:

  • Use the -DcreateChecksum=true param on your mvn install:install-file command.
  • Rename the maven-metadata-local files that are generated to remove the local part.
  • I decided that I would be doing this often enough I would create a bash script to automate the process, maybe you will find it useful as well.

    I designed the script below to run the whole process in a temp directory, then zip up the results, which you can then just upload to your custom repository.

    #! /bin/bash
    USAGE(){
        println "Usage: `basename $0` -g GroupId -a ArtifactId  -f file [-voh] args\n\n";
        println "Options:";
        println "   h   Print usage";
        println "   v   Version (Defaults to 1.0)";
        println "   o   Output zip file name (Defaults to GroupId.ArtifactId.zip)";
    println(){
        echo "$1";
    VERSION="1.0";
    # Parse command line options.
    while getopts hv:o:g:a:f: OPT; do
        case "$OPT" in
                USAGE
                exit 0
              VERSION=$OPTARG;
              GROUP_ID=$OPTARG;
              ARTIFACT_ID=$OPTARG;
                INPUT_FILE=$OPTARG
                OUTPUT_FILE=$OPTARG
                # getopts issues an error message
            echo "Error: " >&2;
                USAGE
                exit 1
    if [ -z "${OUTPUT_FILE}" ]; then
        OUTPUT_FILE="$GROUP_ID.$ARTIFACT_ID.zip";
    # Remove the switches we parsed above.
    shift `expr $OPTIND - 1`
    if [ -z "${ARTIFACT_ID}" ]; then
        echo "Error: You must specify an artifact id."
    if [ -z "${GROUP_ID}" ]; then
        echo "Error: You must specify an group id."
    if [ -z "${INPUT_FILE}" ]; then
        echo "Error: You must specify an group id."
    if [ ! -f "${INPUT_FILE}" ];
         echo "Error: Input file '$INPUT_FILE' does not exist."
    # Create a temp directory which we will use as our 'local repository'
    TEMPDIR=$(mktemp -dt "build-maven-dep.XXXXXXX")
    TEMPDIR_SUB="$GROUP_ID.$ARTIFACT_ID";
    TEMP_REPO_LOC="$TEMPDIR/$TEMPDIR_SUB";
    mkdir -p $TEMP_REPO_LOC;
    mvn install:install-file -DlocalRepositoryPath=$TEMP_REPO_LOC -DgroupId=$GROUP_ID -DartifactId=$ARTIFACT_ID -Dversion=$VERSION -Dfile=$INPUT_FILE -Dpackaging=jar -DgeneratePom=true -DcreateChecksum=true
    CUR_DIR=$(pwd);
    # Enter the temp repository we created which is now populated.
    cd $TEMP_REPO_LOC;
    PACKAGE_STRUC="$GROUP_ID.$ARTIFACT_ID";
    # Dive down into directory structure until we get to the *.xml files.
    IFS='. ' read -ra ADDR <<< $PACKAGE_STRUC
    for i in "${ADDR[@]}"; do
       println "Moving into: $i";
       cd $i;
       println "Now  in $(pwd)";
    # Rename the files to what maven expects.
    mv maven-metadata-local.xml maven-metadata.xml
    mv maven-metadata-local.xml.md5 maven-metadata.xml.md5 
    mv maven-metadata-local.xml.sha1 maven-metadata.xml.sha1
    # Zip up our results.
    cd $TEMP_REPO_LOC;
    cd ..;
    zip -r $OUTPUT_FILE $TEMPDIR_SUB
    mv $OUTPUT_FILE $CUR_DIR
    # Return back to our original directory and remove the temp directory
    cd $CUR_DIR;
    rm -Rf $TEMPDIR;
    # EOF
    

    Say you want to package up myjar.jar for your custom repository:

    ./bundle-for-remote.sh -g com.mygroup -a myJar -f myJar.jar
    

    Which will create a .zip in your current directory called com.mygroup.myJar.zip with all the components.

    Cheers,

    Casey

    Yeah. In my case only -DcreateChecksum=true when mvn install:install-file helped me escape this warning, although the problem was a bit different – fedotsoldier Jul 7, 2019 at 12:59

    From what you pasted above, I don't see com.shunra:license:jar:0.0.1 in your repository. Try installing it into your repository. Or somewhere maven can find it.

    Although the error says "no checksum information available", I think what it really wanted to say was "I can't even find it there"

    Also.. if you're one of those like taking shortcuts, you can always skip the checksum validation by taking away <checksumPolicy>fail</checksumPolicy>

    +1 - Well, they are in the repo, since disabling the checksum policy downloads the respective jars into the local .m2 repository. So, the checksum is truely the problem. BTW, why can't you see them in the repo? Notice the jar files in the dir /s/b output. I would like to credit your reply as the answer, if you could only provide the fix for the checksum issue, right now it is rather a workaround. – mark Jan 16, 2013 at 10:40 on the repository content you pasted above, I can only see two things: com.safenet.hasp:jar and org.jnetcap:jnetcap:jar. I don't see com.shunra:license:jar. Also about the checksum, have you tried taking out <checksumPolicy>fail</checksumPolicy> as I mentioned above? – gerrytan Jan 16, 2013 at 20:41 Yes, it works. But I want to know what is the problem with the repository and how to construct it correctly. shunra:license:jar does not have to be in that repository. It is built from the source, unlike hasp and jnetpcap. – mark Jan 16, 2013 at 23:24 Hmm I think the way you currently configure your maven project -- your project actually tried to find shunra:license:jar from the repository. If you want to build from source all the time, you need to reconfigure the settings. Have a look at maven aggregation tutorial maven.apache.org/guides/introduction/… – gerrytan Jan 17, 2013 at 0:15

    Thanks for contributing an answer to Stack Overflow!

    • Please be sure to answer the question. Provide details and share your research!

    But avoid

    • Asking for help, clarification, or responding to other answers.
    • Making statements based on opinion; back them up with references or personal experience.

    To learn more, see our tips on writing great answers.