Maven 2.2.1 Checksum errors against oss.sonatype.org

[Matthew Buckett <ma...@oucs.ox.ac.uk>]

Hi,

The Sakai project (http://sakaiproject.org) is deploying it's
artifacts against the Sonatype OSS repository and while this works
fine for Maven 3 builds anyone attempting to download the artifacts
using Maven 2.2.1 gets checksum errors against the maven-metadata.xml.

So far it seems that Maven 2.2.1 is not downloading the maven metadata
file directly but is somehow rebuilding the information in it (or
downloading it and stripping it). It's not easy to see if maven is
requesting the file as proxying https connection is hard. As the
metadata files are then different the checksums don't match.

It seems that the sonatype repository has a metadata file that
contains information about the additional artifacts such  as the
sources and javadocs. The metadata about these artifacts isn't
supported by maven 2 and was added for maven 3. However maven 2 was
updated to ignore this extra information.

If I perform a build with maven 3 then the metadata gets updated
correctly and the checksums all match. After I've done a good build
with maven 3 performing another build which updated the snapshot
versions (-U switch) causes maven 2 to update the maven-meta to become
bad. Attached are the metadata that is in my local .m2 repo for maven
2 and maven 3.

-- 
� Matthew Buckett
� VLE Developer, LTG, Oxford University Computing Services

Re: Maven 2.2.1 Checksum errors against oss.sonatype.org

[Anders Hammar <an...@hammar.net>]

I believe this is a Nexus issue as Nexus has a feature of downgrading
the metadata file returned to Maven 2 clients. They *might* have
overlooked the checksum impact of this.
I think your best shot is to ask on the Nexus users list and/or open a
issue ticket for Nexus.

/Anders

On Mon, Mar 19, 2012 at 12:17, Matthew Buckett
<ma...@oucs.ox.ac.uk> wrote:
> Hi,
>
> The Sakai project (http://sakaiproject.org) is deploying it's
> artifacts against the Sonatype OSS repository and while this works
> fine for Maven 3 builds anyone attempting to download the artifacts
> using Maven 2.2.1 gets checksum errors against the maven-metadata.xml.
>
> So far it seems that Maven 2.2.1 is not downloading the maven metadata
> file directly but is somehow rebuilding the information in it (or
> downloading it and stripping it). It's not easy to see if maven is
> requesting the file as proxying https connection is hard. As the
> metadata files are then different the checksums don't match.
>
> It seems that the sonatype repository has a metadata file that
> contains information about the additional artifacts such  as the
> sources and javadocs. The metadata about these artifacts isn't
> supported by maven 2 and was added for maven 3. However maven 2 was
> updated to ignore this extra information.
>
> If I perform a build with maven 3 then the metadata gets updated
> correctly and the checksums all match. After I've done a good build
> with maven 3 performing another build which updated the snapshot
> versions (-U switch) causes maven 2 to update the maven-meta to become
> bad. Attached are the metadata that is in my local .m2 repo for maven
> 2 and maven 3.
>
> --
>   Matthew Buckett
>   VLE Developer, LTG, Oxford University Computing Services
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org