Maven "checksum validation failed, expected xxx but is yyy for" on upload from Jenkins to Artifactory

Question

From time to time Jenkins builds with Maven have a checksum validation failure when uploading to Artifactory:

[INFO] --- maven-deploy-plugin:2.7:deploy (default-deploy) @ example-matcher ---
[INFO] Uploading: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/183/example-matcher-183.pom
[INFO] Uploaded: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/183/example-matcher-183.pom (10 KB at 4.2 KB/sec)
[INFO] Downloading: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml
[WARNING] Checksum validation failed, expected e57ff3c617c84b922d5806a0ba7a9477b274919b but is f64094cf27d28dce9a8fe3fce63dd9c4d113b22a for https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml
[INFO] Downloaded: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml (3 KB at 8.3 KB/sec)
[INFO] Uploading: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml
[INFO] Uploaded: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml (3 KB at 6.2 KB/sec)

Any idea, why this is happening and how to stop it from happening?

Answer 1

This warning message is due to Artifactory's checksum validation feature. When a file is deployed Artifactory, based on the "Checksum Policy" defined in the local repository, will verify the checksum that was sent from the client to Artifactory and if the checksum is not the same you will receive this warning.

You can read more on the "Checksum Policy" here.

Answer 2

I could be wrong, but I'm investigating the same kind of problem, and my reading suggests to me the the warning message is due not to Artifactory complaining about the uploaded file checksum, but rather due to Maven complaining about the downloaded maven-metadata.xml file checksum.

[INFO] Downloading: https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml
[WARNING] Checksum validation failed, expected e57ff3c617c84b922d5806a0ba7a9477b274919b but is f64094cf27d28dce9a8fe3fce63dd9c4d113b22a for https://artifactory.example.com/artifactory/libs-release-local/com/example/test/examplematcher/example-matcher/maven-metadata.xml

(If that's wrong, I'm happy to be corrected.) So I think that partly answers "why this is happening", but I haven't yet figured out "how to stop it from happening".