Why does Maven report "Checksum validation failed, no checksums available from the repository"?

Question

I am trying to create a custom Maven repository using the 3 steps described here - http://www.javaworld.com/community/node/3968. So, I followed all the steps and here I have the repository:

D:\maven2>dir /s/b
D:\maven2\com
D:\maven2\org
D:\maven2\web.config
D:\maven2\com\safenet
D:\maven2\com\safenet\hasp
D:\maven2\com\safenet\hasp\1
D:\maven2\com\safenet\hasp\maven-metadata.xml
D:\maven2\com\safenet\hasp\maven-metadata.xml.md5
D:\maven2\com\safenet\hasp\maven-metadata.xml.sha1
D:\maven2\com\safenet\hasp\1\hasp-1.jar
D:\maven2\com\safenet\hasp\1\hasp-1.pom
D:\maven2\com\safenet\hasp\1\_maven.repositories
D:\maven2\org\jnetpcap
D:\maven2\org\jnetpcap\jnetcap
D:\maven2\org\jnetpcap\jnetcap\1.3
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml.md5
D:\maven2\org\jnetpcap\jnetcap\maven-metadata.xml.sha1
D:\maven2\org\jnetpcap\jnetcap\1.3\jnetcap-1.3.jar
D:\maven2\org\jnetpcap\jnetcap\1.3\jnetcap-1.3.pom
D:\maven2\org\jnetpcap\jnetcap\1.3\_maven.repositories

D:\maven2>type com\safenet\hasp\maven-metadata.xml
<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.safenet</groupId>
  <artifactId>hasp</artifactId>
  <versioning>
    <release>1</release>
    <versions>
      <version>1</version>
    </versions>
    <lastUpdated>20130108125547</lastUpdated>
  </versioning>
</metadata>

D:\maven2>type org\jnetpcap\jnetcap\maven-metadata.xml.md5
297455697088aad6bdbe256d48fb0676 *maven-metadata.xml

D:\maven2>type org\jnetpcap\jnetcap\maven-metadata.xml.sha1
f86d93727a76525f42f1b67997020e1a9a41b948 *maven-metadata.xml

D:\maven2>type org\jnetpcap\jnetcap\1.3\jnetcap-1.3.pom
<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.jnetpcap</groupId>
  <artifactId>jnetcap</artifactId>
  <version>1.3</version>
  <description>POM was created from install:install-file</description>
</project>

D:\maven2>

Now I am trying to use the hasp artifact in a pom file like this:

<dependency>
  <groupId>com.safenet</groupId>
  <artifactId>hasp</artifactId>
  <version>1</version>
  <scope>provided</scope>
</dependency>

And the repository is referenced like this:

<repository>
  <releases>
    <enabled>true</enabled>
    <updatePolicy>always</updatePolicy>
    <checksumPolicy>fail</checksumPolicy>
  </releases>
  <id>dev-builder</id>
  <name>Shunra private repository</name>
  <url>http://dev-builder/maven2</url>
  <layout>default</layout>
</repository>

Unfortunately, it does not work as expected:

[INFO] Building license 0.0.1
[INFO] ------------------------------------------------------------------------
Downloading: http://dev-builder/maven2/com/safenet/hasp/1/hasp-1.pom
[WARNING] The POM for com.safenet:hasp:jar:1 is missing, no dependency information available
Downloading: http://dev-builder/maven2/com/safenet/hasp/1/hasp-1.jar
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO]
[INFO] Local Driver Proxy ................................ SUCCESS [2.579s]
[INFO] Emulation API ..................................... SUCCESS [1.637s]
[INFO] util.logging ...................................... SUCCESS [1.023s]
[INFO] Infra ............................................. SUCCESS [0.250s]
[INFO] dtos .............................................. SUCCESS [0.691s]
[INFO] commons ........................................... SUCCESS [0.426s]
[INFO] license ........................................... FAILURE [2.195s]
[INFO] core .............................................. SKIPPED
[INFO] vcat .............................................. SKIPPED
[INFO] VCat-build ........................................ SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 9.044s
[INFO] Finished at: Tue Jan 15 21:27:43 EST 2013
[INFO] Final Memory: 6M/15M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project license: Could not resolve dependencies for project com.shunra:license:jar:0.0.1: Could not transfer artifact com.safenet:hasp:jar:1 from/to dev-builder (http
://dev-builder/maven2): Checksum validation failed, no checksums available from the repository -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :license
c:\dev\shunra\Application\Builder\build\vcat>

I have no idea what is the problem with it. The md5 and sha1 files were created using the cygwin port of the md5sum and sha1sum utilities. Still, Maven reports bad checksum.

Answer 1

I came here looking for the same answer. After spending hours trying to figure it out I finally found that the reason this is happening is two fold:

1. The checksums created by md5sum and shasum are not exactly what maven is looking for
2. You need checksums for all the files.

So basically that tutorial on javaworld.com is completely or at least partially wrong.

So whats the answer:

1. Use the -DcreateChecksum=true param on your mvn install:install-file command.
2. Rename the maven-metadata-local files that are generated to remove the local part.

I decided that I would be doing this often enough I would create a bash script to automate the process, maybe you will find it useful as well.

I designed the script below to run the whole process in a temp directory, then zip up the results, which you can then just upload to your custom repository.

#! /bin/bash

USAGE(){
    println "Usage: `basename $0` -g GroupId -a ArtifactId  -f file [-voh] args\n\n";

    println "Options:";
    println "   h   Print usage";
    println "   v   Version (Defaults to 1.0)";
    println "   o   Output zip file name (Defaults to GroupId.ArtifactId.zip)";


}
println(){

    echo "$1";
}


VERSION="1.0";

# Parse command line options.
while getopts hv:o:g:a:f: OPT; do
    case "$OPT" in
        h)
            USAGE
            exit 0
            ;;
        v)
          VERSION=$OPTARG;
            ;;
    g)
          GROUP_ID=$OPTARG;
            ;;
    a)
          ARTIFACT_ID=$OPTARG;
            ;;
    f)
            INPUT_FILE=$OPTARG
            ;;
        o)
            OUTPUT_FILE=$OPTARG
            ;;
        \?)
            # getopts issues an error message
        echo "Error: " >&2;
            USAGE
            exit 1
            ;;
    esac
done

if [ -z "${OUTPUT_FILE}" ]; then
    OUTPUT_FILE="$GROUP_ID.$ARTIFACT_ID.zip";
fi



# Remove the switches we parsed above.
shift `expr $OPTIND - 1`

if [ -z "${ARTIFACT_ID}" ]; then
    echo "Error: You must specify an artifact id."
fi

if [ -z "${GROUP_ID}" ]; then
    echo "Error: You must specify an group id."
fi

if [ -z "${INPUT_FILE}" ]; then
    echo "Error: You must specify an group id."
fi

if [ ! -f "${INPUT_FILE}" ];
then
     echo "Error: Input file '$INPUT_FILE' does not exist."
fi

# Create a temp directory which we will use as our 'local repository'
TEMPDIR=$(mktemp -dt "build-maven-dep.XXXXXXX")

TEMPDIR_SUB="$GROUP_ID.$ARTIFACT_ID";
TEMP_REPO_LOC="$TEMPDIR/$TEMPDIR_SUB";
mkdir -p $TEMP_REPO_LOC;

mvn install:install-file -DlocalRepositoryPath=$TEMP_REPO_LOC -DgroupId=$GROUP_ID -DartifactId=$ARTIFACT_ID -Dversion=$VERSION -Dfile=$INPUT_FILE -Dpackaging=jar -DgeneratePom=true -DcreateChecksum=true

CUR_DIR=$(pwd);

# Enter the temp repository we created which is now populated.
cd $TEMP_REPO_LOC;

PACKAGE_STRUC="$GROUP_ID.$ARTIFACT_ID";

# Dive down into directory structure until we get to the *.xml files.
IFS='. ' read -ra ADDR <<< $PACKAGE_STRUC
for i in "${ADDR[@]}"; do
   println "Moving into: $i";
   cd $i;
   println "Now  in $(pwd)";
done

# Rename the files to what maven expects.
mv maven-metadata-local.xml maven-metadata.xml
mv maven-metadata-local.xml.md5 maven-metadata.xml.md5 
mv maven-metadata-local.xml.sha1 maven-metadata.xml.sha1

# Zip up our results.
cd $TEMP_REPO_LOC;
cd ..;
zip -r $OUTPUT_FILE $TEMPDIR_SUB
mv $OUTPUT_FILE $CUR_DIR

# Return back to our original directory and remove the temp directory
cd $CUR_DIR;
rm -Rf $TEMPDIR;

# EOF

Say you want to package up myjar.jar for your custom repository:

./bundle-for-remote.sh -g com.mygroup -a myJar -f myJar.jar

Which will create a .zip in your current directory called com.mygroup.myJar.zip with all the components.

Cheers,

Casey

Answer 2

From what you pasted above, I don't see com.shunra:license:jar:0.0.1 in your repository. Try installing it into your repository. Or somewhere maven can find it.

Although the error says "no checksum information available", I think what it really wanted to say was "I can't even find it there"

Also.. if you're one of those like taking shortcuts, you can always skip the checksum validation by taking away <checksumPolicy>fail</checksumPolicy>