Maven "Checksum validation failed" - Fix Corrupted Downloads in CI

Maven downloaded an artifact whose checksum did not match the published one. The file is corrupt or truncated - usually from an interrupted download, a flaky mirror, or a stale partial file in ~/.m2.

What this error means

Resolution warns or fails with Checksum validation failed, expected <sha1> but is <sha1> for a specific artifact. Deleting that path from ~/.m2 and re-resolving typically fixes it.

[WARNING] Checksum validation failed, expected
3a1b... but is 0000... for org.example:lib:jar:1.0
[ERROR] Could not validate integrity of download from
https://repo.example.com/.../lib-1.0.jar

Common causes

Truncated or corrupted download

An interrupted transfer or a flaky mirror left a partial/garbled file in the local repository. Its checksum no longer matches the expected value.

Mirror served a wrong or HTML error body

A misconfigured mirror can return an error page or a stale artifact in place of the real jar, so the bytes hash to something unexpected.

How to fix it

Purge the bad artifact and re-resolve

Remove the corrupt path from ~/.m2 and force a fresh download.

rm -rf ~/.m2/repository/org/example/lib/1.0
mvn -U -B dependency:resolve

Choose the right checksum policy

Keep validation strict to catch corruption; only relax it deliberately and temporarily.

# strict (recommended) - fail on a bad checksum:
mvn -B -C verify
# warn instead of fail (temporary triage only):
# mvn -B -c verify

How to prevent it

• Resolve through a single trusted mirror that proxies and caches correctly.
• Avoid persisting ~/.m2 from interrupted/OOM-killed runs.
• Keep checksum policy strict (-C) so corruption fails fast.

Related guides