Maven "Could not validate integrity ... checksum" in CI
Maven downloaded an artifact and its .sha1/.md5, then compared them and they disagree. With strict checksum policy the build fails rather than trust a possibly corrupt or substituted file.
What this error means
Resolution fails with "Could not validate integrity of download ...: Checksum validation failed, expected <hash> but is <hash>", usually from a mirror or proxy.
mvn output
[WARNING] Could not validate integrity of download from
https://nexus.example.com/repository/maven-central/org/foo/foo/1.2/foo-1.2.jar:
Checksum validation failed, expected 6e2f... but is a91b...
[ERROR] Failed to execute goal ... checksum failed for foo-1.2.jarCommon causes
A corrupted transfer through a mirror or proxy
A mirror returned a body that does not match its checksum, often after a partial transfer or cache corruption upstream.
A stale or mismatched checksum file
The .sha1 cached locally refers to a different version of the artifact, so validation fails for the served file.
How to fix it
Clear the bad artifact and re-resolve
- Remove the artifact and its checksum from
~/.m2. - Re-run so a fresh, matching pair is downloaded.
- If a specific mirror keeps failing, switch mirrors.
Terminal
mvn -B dependency:purge-local-repository -DmanualInclude=org.foo:foo
mvn -B verifyKeep strict checksums but fix the source
Do not weaken to warn. Repair the mirror or point Maven at a trustworthy repository so checksums match.
How to prevent it
- Keep checksum policy strict (
-C) and fix upstream sources. - Avoid caching artifacts that failed checksum validation.
- Use a reliable mirror that serves consistent checksums.
Frequently asked questions
What causes ""Checksum validation failed""?
A mirror returned a body that does not match its checksum, often after a partial transfer or cache corruption upstream.
How do I fix "Checksum validation failed"?
Clear the bad artifact and re-resolve
Can Latchkey fix this automatically?
Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.
Related guides
Maven corrupt cached JAR "zip END header not found" in CIFix Maven "error in opening zip file / zip END header not found" in CI - a JAR in the local ~/.m2 repository…
Maven "Premature end of Content-Length" transfer in CIFix Maven "Premature end of Content-Length delimited message body" in CI - an artifact download was truncated…
Maven "transfer failed ... 503 Service Unavailable" in CIFix Maven "Could not transfer artifact ... status code: 503, reason phrase: Service Unavailable" in CI - the…