Checksum failure of wstx-asl-3.2.8.jar on maven central

[Ulf Lindback]

Hi!
When trying to download the wstx-asl-3.2.8.jar from maven central: http://repo1.maven.org/maven2/org/codehaus/woodstox/wstx-asl/3.2.8/wstx-asl-3.2.8.jar 
I get checksum errors (the md5 and sh1 files are the same as they are ath http://repository.codehaus.org/org/codehaus/woodstox/wstx-asl/3.2.8 so it must
be the JAR that is corrupt at the central (size 523825 at central and size 522787 at codehaus).

Is it possible to somehow push out a correct version to the central repository?
 (No I cannot use a newer version, since I use it indirectly through cxf which depends on wstx-asl:jar:3.2.8 and I can download a correct version, but we have
a local artifactory which cannot get it due to the invalid checksum)

Regards
/Ulf Lindback

[Cowtowncoder]

On Tue, Nov 3, 2009 at 1:21 AM, Ulf Lindback <lindback@...> wrote:
> Hi!
> When trying to download the wstx-asl-3.2.8.jar from maven central:
> http://repo1.maven.org/maven2/org/codehaus/woodstox/wstx-asl/3.2.8/wstx-asl-3.2.8.jar
> I get checksum errors (the md5 and sh1 files are the same as they are ath
> http://repository.codehaus.org/org/codehaus/woodstox/wstx-asl/3.2.8 so it
> must
> be the JAR that is corrupt at the central (size 523825 at central and size
> 522787 at codehaus).

This could be because earlier Maven pushes were done manually (just uploading).
In this case there must have been something wrong with the initial jar
version, which was replaced, but not before broken version was
propagated. Unfortunately Maven does not seem to be able to resolve
such cases.

> Is it possible to somehow push out a correct version to the central
> repository?
>  (No I cannot use a newer version, since I use it indirectly through cxf
> which depends on wstx-asl:jar:3.2.8 and I can download a correct version,
> but we have
> a local artifactory which cannot get it due to the invalid checksum)

Maven's artifact distribution system is problematic, since it seems
that once a version has been propagated it is very difficult to
replace it. :-/
I do have access to Codehaus repository, but unfortunately not to
central Maven repository. If anyone knows who might be able to help, I
could contact that person to see if it was possible to delete current
version and let fixed version be synced from Codehaus repository.

Another possibility would be try to convince CXF folks either upgrade
to 3.2.9 (patch versions are very safe in this direction), or make
dependency less strict (using [3.2.0,3.3.0), or whatever notation is
to basically allow 3.2.x).

Apologies for the mess up -- current deployments should work better
with Ant Maven tasks, so this should not recur. But that was not yet
the case for 3.2.8.

-+ Tatu +-

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Ulf Lindback]

Ok, thanks for the promptly reply.

/Ulf

On Tue, Nov 3, 2009 at 19:40, Tatu Saloranta <tsaloranta@...> wrote:

On Tue, Nov 3, 2009 at 1:21 AM, Ulf Lindback <lindback@...> wrote:
> Hi!
> When trying to download the wstx-asl-3.2.8.jar from maven central:
> http://repo1.maven.org/maven2/org/codehaus/woodstox/wstx-asl/3.2.8/wstx-asl-3.2.8.jar
> I get checksum errors (the md5 and sh1 files are the same as they are ath
> http://repository.codehaus.org/org/codehaus/woodstox/wstx-asl/3.2.8 so it
> must
> be the JAR that is corrupt at the central (size 523825 at central and size
> 522787 at codehaus).

This could be because earlier Maven pushes were done manually (just uploading).
In this case there must have been something wrong with the initial jar
version, which was replaced, but not before broken version was
propagated. Unfortunately Maven does not seem to be able to resolve
such cases.

> Is it possible to somehow push out a correct version to the central
> repository?
>  (No I cannot use a newer version, since I use it indirectly through cxf
> which depends on wstx-asl:jar:3.2.8 and I can download a correct version,
> but we have
> a local artifactory which cannot get it due to the invalid checksum)

Maven's artifact distribution system is problematic, since it seems
that once a version has been propagated it is very difficult to
replace it. :-/
I do have access to Codehaus repository, but unfortunately not to
central Maven repository. If anyone knows who might be able to help, I
could contact that person to see if it was possible to delete current
version and let fixed version be synced from Codehaus repository.

Another possibility would be try to convince CXF folks either upgrade
to 3.2.9 (patch versions are very safe in this direction), or make
dependency less strict (using [3.2.0,3.3.0), or whatever notation is
to basically allow 3.2.x).

Apologies for the mess up -- current deployments should work better
with Ant Maven tasks, so this should not recur. But that was not yet
the case for 3.2.8.

-+ Tatu +-

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

   http://xircles.codehaus.org/manage_email