Incorrect sha1 file for grpc-core/maven-metadata.xml uploaded to repo1.maven.org

[pavulonx]

What version of gRPC-Java are you using?

n/a

What is your environment?

n/a

What did you expect to see?

maven-metadata.xml.sha1 matching sha1sum of maven-metadata.xml

What did you see instead?

curl -fLs https://repo1.maven.org/maven2/io/grpc/grpc-core/maven-metadata.xml | sha1sum
# b90b4b96efc039b9d0fca5c9827e9d12782e6779

not matching sha1 defined in maven-metadata.xml.sha1 - 5d574c5e81b00d67284f5fd9a23dfea4d97f3d43

Steps to reproduce the bug

meta="$(curl -fLs "https://repo1.maven.org/maven2/io/grpc/grpc-core/maven-metadata.xml")" 
for cs in md5 sha1 sha256 sha512; do
  printf '%s: ' "$cs"
  test "$(echo "$meta" | "${cs}sum" - | cut -d' ' -f1)" = "$(curl -fLs "https://repo1.maven.org/maven2/io/grpc/grpc-core/maven-metadata.xml.${cs}")" && echo "OK" || echo "FAIL"
done

out:

md5: OK
sha1: FAIL
sha256: OK
sha512: OK

[bacchanalia]

I've also hit this. Anyone know of a workaround?

[ejona86]

We don't generate those files... Those are generated by Sonatype.

What tool are you using that is using the checksum from the version listing?

[slackhappy]

I ran into this checksum issue with coursier (used by pants and sbt)

[pavulonx]

I was using coursier via sbt.

@bacchanalia As a dirty workaround you can set useCoursier := false in your build.sbt file.

[bacchanalia]

@pavulonx Thanks.

I think this has been fixed on the maven.org end.

[ejona86]

Oh, yeah, it does look fixed.

What I had written:

---

The date on the sha1 is the same as the xml, so it doesn't look like an incomplete update... Except maven-metadata.xml.asc is a signature of ours from 2018, it doesn't match the maven-metadata.xml and it has the recent date. A similar file isn't in grpc-api which was created in 2019. So I think the date is a lie here.

Today or Monday we will be releasing a new patch version, so the files should get regenerated and we can hope it doesn't fail in the same way. grpc-api has good checksums, so it doesn't seem like sha1 support has been dropped (although when I checked grpc-core may have also been working).

[ejona86]

Since the date didn't update, another possibility is a mirror had a torn sync.

Closing since things fixed themselves. We'll chalk it up to a glitch in the Matrix.