• Bug
  • Status: New
  • 2 Major
  • Resolution:
  • drb
  • Reporter: b2s_aree
  • December 03, 2014
  • 0
  • Watchers: 1
  • December 03, 2014

Description

Our Artifactory repo is complaining about checksum mismatches when download the maven-metainfo.xml file. When we download the corresponding “maven-metainfo.xml.md5” file, the checksum container therein does not match the actual md5sum.

The workaround is to turn off checksum checking for the terracotta repo but that’s a tad insecure.

I have include steps to reproduce at the end.

Here’s the error message from Artifactory.

2014-12-01 16:19:41,934 [http-bio-8009-exec-2053] [ERROR] (o.a.r.HttpRepo      :295) - terracotta: Failed to download 
 'http://www.terracotta.org/download/reflector/releases/org/eclipse/equinox/preferences/maven-metadata.xml'. 
 Received status code 200 and caught exception: 
 Checksum policy 'FAIL' rejected the artifact 'terracotta-cache:org/eclipse/equinox/preferences/maven-metadata.xml'. 
 Checksums info: ChecksumsInfo{checksums=
 {SHA-1=ChecksumInfo{type=SHA-1, 
 original='5a3c1019c472a66fa13c8f9203fb63a846586b34', 
 actual='26b0df5f69bf99884ed3a2c90c6bf08e0194e019'}, 
 MD5=ChecksumInfo{type=MD5, 
 original='0059c197e9748fbf34a1e311443e0ac1', 
 actual='40cb0995141d493a728d8cd2c2640072'}}}

To Reproduce the problem: When we do a wget of a maven-metadata.xml file and its .md5 checksum file, we also see the checksum mismatch:


 $ wget http://www.terracotta.org/download/reflector/releases/org/eclipse/osgi/maven-metadata.xml
 
 $ wget http://www.terracotta.org/download/reflector/releases/org/eclipse/osgi/maven-metadata.xml.md5
 
 $ md5sum maven-metadata.xml
 5f0afe0979181967ed1d9c61ed2774a8 *maven-metadata.xml
 
 $ cat maven-metadata.xml.md5
 ee93aaec5be19f235a71db6541c1de5c

As you can see the md5sum doesn’t match the md5sum in the *.md5 file.

This is happened for multiple terracotta files.

Also, I am assuming that this is the place to lodge such an issue.

Comments