Maven "Checksum validation failed" - Fix Corrupted Downloads in CI
By Daniel Zoghalchali·Latchkey
Maven downloaded an artifact whose checksum did not match the published one. The file is corrupt or truncated - usually from an interrupted download, a flaky mirror, or a stale partial file in ~/.m2.
What this error means
Resolution warns or fails with Checksum validation failed, expected <sha1> but is <sha1> for a specific artifact. Deleting that path from ~/.m2 and re-resolving typically fixes it.
mvn output
[WARNING] Checksum validation failed, expected
3a1b... but is 0000... for org.example:lib:jar:1.0
[ERROR] Could not validate integrity of download from
https://repo.example.com/.../lib-1.0.jar
Common causes
Truncated or corrupted download
An interrupted transfer or a flaky mirror left a partial/garbled file in the local repository. Its checksum no longer matches the expected value.
Mirror served a wrong or HTML error body
A misconfigured mirror can return an error page or a stale artifact in place of the real jar, so the bytes hash to something unexpected.
How to fix it
Purge the bad artifact and re-resolve
Remove the corrupt path from ~/.m2 and force a fresh download.
Keep validation strict to catch corruption; only relax it deliberately and temporarily.
Terminal
# strict (recommended) - fail on a bad checksum:
mvn -B -C verify
# warn instead of fail (temporary triage only):# mvn -B -c verify
How to prevent it
Resolve through a single trusted mirror that proxies and caches correctly.
Avoid persisting ~/.m2 from interrupted/OOM-killed runs.
Keep checksum policy strict (-C) so corruption fails fast.
Frequently asked questions
What causes ""Checksum validation failed""?
An interrupted transfer or a flaky mirror left a partial/garbled file in the local repository. Its checksum no longer matches the expected value.
How do I fix "Checksum validation failed"?
Remove the corrupt path from ~/.m2 and force a fresh download.
Can Latchkey fix this automatically?
Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.
