Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.
If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!
Maven Metadata Checksum Warnings
-
Hi,
I have a issue reported from one of my users:
~~
When requesting Maven packages from <Some Maven Repo in ProGet> during Build, we receive Checksum Warnings for the file maven-metadata.xml.
We analyzed this and found out, that the file in the Repository is sometimes re-generated. In these cases the order of the XML-elements changes and the checksum is not matching anymore.
From our perspective the maven-metadata.xml should be cached on the server and only re-generated when a new package is uploaded. Can you check if something is configured wrong?
~~I didn't do the analysis myself, but the report makes sense. So my question: Is the maven-metadata re-generated on-the-fly? And might there be some non-deterministic behaviour, that breaks the checksums? Or is this some nasty Race-Condition?
-
Hi @wechselberg-nisboerge_3629,
In ProGet, the maven metadata files (xml, hash) are indeed generated upon request. The output is deterministic, based on the artifacts in storage and (if relevant) in the remote repository (i.e. connectors). So, if you're seeing it changed, it's because an artifact was uploaded/etc.
One thing to note -- you cannot upload a metadata file or hash file. Well, you can try (and maven tries) to PUT the file, but the stream is always ignored or "written to
/dev/null" as they say.We've seen some maven workflows/plugins that attempt to modify/append to this metadata file and re-upload it with changes.
Thanks,
Alana
