Checksum validation fail using Maven - Java - Travis CI Community

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

聪明伶俐的跑步鞋 · ApacheLog4j2远程代码执行漏洞CV ...· 4 周前 ·

腼腆的香菇 · Apache HertzBeat · An ...· 3 周前 ·

强健的回锅肉 · Migrating Jira ...· 2 周前 ·

聪明伶俐的大熊猫 · 往往排查很久的问题，最后发现都非常简单。。。 ...· 2 周前 ·

没有腹肌的开水瓶 · Exception in thread ...· 1 周前 ·

谦逊的红豆 · js如何将一个整数变成浮点数 | ...· 1 月前 ·

踢足球的茶壶 · 数据库什么是保持FD • Worktile社区· 7 月前 ·

彷徨的仙人掌 · 【比亚迪2022款比亚迪汉DM-i ...· 1 年前 ·

正直的钥匙扣 · 安卓编辑文本界面在调用Firebase后冻结了· 1 年前 ·

温暖的椅子 · 妖怪酒馆漫画免费 - 妖怪酒馆漫画 - ...· 1 年前 ·

Hello,

Since around 1 week there has been some issues with Maven central repo denying access to Travis builds (see Continuous maven repo 403 ).

The fix as of today consists in using google mirror of Maven central. However using this mirror, I get checksum validation failures in some of my builds. This include, for instance, the preesm/graphiti project, with :

last working build https://travis-ci.org/preesm/graphiti/builds/550544536

first failing due to maven central access denied https://travis-ci.org/preesm/graphiti/builds/551052166

first failing due to checksum issue https://travis-ci.org/preesm/graphiti/builds/551545973

I could reproduce locally playing with local maven settings ( https://stackoverflow.com/a/4997553 ). When I use the default central repository, the build runs fine.

Best.

Hello again,

Below are 2 notes about the current build failures of the Graphiti project on travis:

Note: Since less than 1 week, Oracle certificates expired (or something is wrong with travis openjdk9 setup script), leading to failures way before the one described in first post. This does not happen if build is triggered somewhere else.

Note2: Also, the main Eclipse mirror used to build the project (the only French Eclipse mirror, closest to the work place) went down few days ago, also leading to failures before the one described in first post. Latest updates on the graphiti github repo develop branch includes the fix to use another (still online) mirror.

Cascade of upstream issues this week :<

https://travis-ci.org/preesm/graphiti/builds/551545973 is helpful, you should be able to replicate it locally by the following in your ~/.m2/settings.xml file:

  <mirrors>
    <mirror>
      <id>google-maven-central</id>
      <name>Google Maven Central</name>
      <url>https://storage-download.googleapis.com/maven-central/repos/central/data/</url>
      <mirrorOf>central</mirrorOf>
    </mirror>
  </mirrors>
I’ll look into the missing files – if that’s all it is, I should be able to fix in an hour or two, but figuring out why might take longer.  Will update the issue in 30 min.
              @antoine-morvan  I’ve verified that the checksums do exist and appear to match.  Could you try executing again and seeing if there is still a problem?
@BanzaiMan Is it possible that a bad .m2 cache occured?  Is it possible to rerun maven with the -X option to see what might be going on?
 lesv:
Is it possible that a bad .m2 cache occured? Is it possible to rerun maven with the -X option to see what might be going on?
Our VMs start with a base image with nothing in ~/.m2, so I am doubtful that the cache comes into play. It is possible to run mvn with -X; it is best done by @antoine-morvan by tweaking .travis.yml.
I enabled -X on a branch, but I fear it’ll exceed the log size limit (see mavenDebug branch https://travis-ci.org/preesm/graphiti/builds/553717616 … but the openjdk9 certs :<).
Even locally I clear my cache before change the remote repos to make sure other people can continue build the project anywhere. And the travis build do not cache the local repo either to enforce that behavior.
Also, in case you missed it, the build script uses the -C option : “-C,–strict-checksums : Fail the build if checksums don’t match”.
@lesv Clearing repo and running again locally. Updating soon with result.
Best.
              I running out of the office today, and will be out for a few days for the holidays.    You might wish to roll back to using the maven-central repo for now.
  <mirrors>
    <mirror>
      <id>maven-central</id>
      <name>Maven Central</name>
      <url>https://repo1.maven.org/maven2/</url>
    </mirror>
  </mirrors>
Looking at the mirror, I see:
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-javadoc.jar
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-javadoc.jar-hash-report.json
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-javadoc.jar-hashes.tsv
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-javadoc.jar.asc
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-source-release.zip
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-source-release.zip-hash-report.json
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-source-release.zip-hashes.tsv
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-source-release.zip.asc
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-sources.jar
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-sources.jar-hash-report.json
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-sources.jar-hashes.tsv
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3-sources.jar.asc
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.jar
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.jar-hash-report.json
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.jar-hashes.tsv
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.jar.asc
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.pom
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.pom-hash-report.json
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.pom-hashes.tsv
gs://maven-central/repos/central/data/org/apache/maven/reporting/maven-reporting-impl/2.3/maven-reporting-impl-2.3.pom.asc
And on Maven-Central repo1 I see:
maven-reporting-impl-2.3-javadoc.jar              2014-09-14 15:42     59624      
maven-reporting-impl-2.3-javadoc.jar.asc          2014-09-14 15:42       181      
maven-reporting-impl-2.3-javadoc.jar.asc.md5      2014-09-14 15:42        32      
maven-reporting-impl-2.3-javadoc.jar.asc.sha1     2014-09-14 15:42        40      
maven-reporting-impl-2.3-javadoc.jar.md5          2014-09-14 15:42        32      
maven-reporting-impl-2.3-javadoc.jar.sha1         2014-09-14 15:42        40      
maven-reporting-impl-2.3-source-release.zip       2014-09-14 15:42     28693      
maven-reporting-impl-2.3-source-release.zip.a...  2014-09-14 15:42       181      
maven-reporting-impl-2.3-source-release.zip.a...  2014-09-14 15:42        32      
maven-reporting-impl-2.3-source-release.zip.a...  2014-09-14 15:42        40      
maven-reporting-impl-2.3-source-release.zip.m...  2014-09-14 15:42        32      
maven-reporting-impl-2.3-source-release.zip.s...  2014-09-14 15:42        40      
maven-reporting-impl-2.3-sources.jar              2014-09-14 15:42     15630      
maven-reporting-impl-2.3-sources.jar.asc          2014-09-14 15:42       181      
maven-reporting-impl-2.3-sources.jar.asc.md5      2014-09-14 15:42        32      
maven-reporting-impl-2.3-sources.jar.asc.sha1     2014-09-14 15:42        40      
maven-reporting-impl-2.3-sources.jar.md5          2014-09-14 15:42        32      
maven-reporting-impl-2.3-sources.jar.sha1         2014-09-14 15:42        40      
maven-reporting-impl-2.3.jar                      2014-09-14 15:42     17978      
maven-reporting-impl-2.3.jar.asc                  2014-09-14 15:42       181      
maven-reporting-impl-2.3.jar.asc.md5              2014-09-14 15:42        32      
maven-reporting-impl-2.3.jar.asc.sha1             2014-09-14 15:42        40      
maven-reporting-impl-2.3.jar.md5                  2014-09-14 15:42        32      
maven-reporting-impl-2.3.jar.sha1                 2014-09-14 15:42        40      
maven-reporting-impl-2.3.pom                      2014-09-14 15:42      5000      
maven-reporting-impl-2.3.pom.asc                  2014-09-14 15:42       181      
maven-reporting-impl-2.3.pom.asc.md5              2014-09-14 15:42        32      
maven-reporting-impl-2.3.pom.asc.sha1             2014-09-14 15:42        40      
maven-reporting-impl-2.3.pom.md5                  2014-09-14 15:42        32      
maven-reporting-impl-2.3.pom.sha1                 2014-09-14 15:42        40      
I need to ask the folks at Sonatype and the PMC why I would have unexepected files and not have the expected ones.
              Not sure if I can override the Travis VM settings… but that is indeed what we use locally.
I will disable strict checking for now and re-enable after holidays 
              Hi, I’m having the same Issue and it’s still failing due unavailable checksums
See https://travis-ci.org/nuessgens/tyrus/builds/559126235
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-checkstyle-plugin:3.0.0:check (default) on project tyrus-project: Execution default of goal org.apache.maven.plugins:maven-checkstyle-plugin:3.0.0:check failed: Plugin org.apache.maven.plugins:maven-checkstyle-plugin:3.0.0 or one of its dependencies could not be resolved: Failed to collect dependencies at org.apache.maven.plugins:maven-checkstyle-plugin:jar:3.0.0 -> org.apache.maven.reporting:maven-reporting-impl:jar:2.3: Failed to read artifact descriptor for org.apache.maven.reporting:maven-reporting-impl:jar:2.3: Could not transfer artifact org.apache.maven.reporting:maven-reporting-impl:pom:2.3 from/to google-maven-central (https://maven-central.storage-download.googleapis.com/repos/central/data/): Checksum validation failed, no checksums available -> [Help 1]
              Sorry - I spoke too soon.  It appears my sync between my VM and the bucket got killed just after midnight, I’ve restarted it, but it takes a while to process 12T.  I’ll let you know when it’s actually done.
For the time being, don’t use checksum’s using mvn -C
Going forward Sonatype is working on a new source repository for me to use, I will also let you know when that is completed.
              Builds of new branches (1.15-BRANCH) get passed the checksum verification now (as you can see here https://travis-ci.org/nuessgens/tyrus/builds/560619011)… at least until it is terminated because “the job exceeded the maximum log length”
But for previously failed branches (master) I now get the following error (https://travis-ci.org/nuessgens/tyrus/builds/560618865):
[ERROR] Plugin org.codehaus.mojo:build-helper-maven-plugin:1.8 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.codehaus.mojo:build-helper-maven-plugin:jar:1.8: Could not transfer artifact org.codehaus.mojo:build-helper-maven-plugin:pom:1.8 from/to google-maven-central (https://maven-central.storage-download.googleapis.com/repos/central/data/): Checksum validation failed, expected dfc6267db807f9c21415b7eef50137742e99c364 but is 74a16507270d0d85a77b15b5f5e97010d193cb9b -> [Help 1]
Any Idea how I can start over with this branch (I already tried deleting caches without any luck)
              @BanzaiMan can give you suggestions on the right way to do this.  What you are trying for is effectively mvn clean; rm -r ~/.m2
FYI: My update job is still running, so more checksums are correct, but it’s not complete yet.  I’ll need to do some cleanup / validation once it finishes.
              I’m afraid the checksums are still wrong.

I tried removing the whole $HOME/.m2 folder (which resulted in downloading the artifacts from maven-central) as well as just removing  $HOME/.m2/repository.
It seems the cached checksums are note the problem but rather the checksums returned by the maven-central.storage-download.googleapis.com-Mirror
E.g. try the following
$ curl -s https://maven-central.storage-download.googleapis.com/repos/central/data/org/codehaus/mojo/build-helper-maven-plugin/1.8/build-helper-maven-plugin-1.8.pom | sha1sum 
74a16507270d0d85a77b15b5f5e97010d193cb9b *-
$ curl -s https://maven-central.storage-download.googleapis.com/repos/central/data/org/codehaus/mojo/build-helper-maven-plugin/1.8/build-helper-maven-plugin-1.8.pom.sha1
dfc6267db807f9c21415b7eef50137742e99c364
As one can see the SHA1 values differ.
In case I try the same with maven-central, I get the following results:
$ curl -s https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/1.8/build-helper-maven-plugin-1.8.pom | sha1sum
74a16507270d0d85a77b15b5f5e97010d193cb9b *-
$ curl -s https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/1.8/build-helper-maven-plugin-1.8.pom.sha1
74a16507270d0d85a77b15b5f5e97010d193cb9b