apache/maven · warning · InvalidArtifactRTException

The type cannot be empty.

Error message

The type cannot be empty.

What it means

Checksum verification failed and the repository's checksumPolicy resolved to 'warn' (anything other than fail or ignore): handleChecksumFailure logs this warning and keeps the downloaded artifact, so the build succeeds with a file whose integrity was not proven.

Source

Thrown at compat/maven-artifact/src/main/java/org/apache/maven/artifact/DefaultArtifact.java:177

        this.optional = optional;

        validateIdentity();
    }

    private void validateIdentity() {
        if (empty(groupId)) {
            throw new InvalidArtifactRTException(
                    groupId, artifactId, getVersion(), type, "The groupId cannot be empty.");
        }

        if (empty(artifactId)) {
            throw new InvalidArtifactRTException(
                    groupId, artifactId, getVersion(), type, "The artifactId cannot be empty.");
        }

        if (empty(type)) {
            throw new InvalidArtifactRTException(groupId, artifactId, getVersion(), type, "The type cannot be empty.");
        }

        if ((empty(version)) && (versionRange == null)) {
            throw new InvalidArtifactRTException(
                    groupId, artifactId, getVersion(), type, "The version cannot be empty.");
        }
    }

    public static boolean empty(String value) {
        return value == null || value.isBlank();
    }

    @Override
    public String getClassifier() {
        return classifier;
    }

    @Override

View on GitHub (pinned to e4093d4e12)

Solutions

1. If integrity matters, set <checksumPolicy>fail</checksumPolicy> on the repository or mirror in settings.xml
2. Delete the artifact from the local repository and re-fetch with -U; compare sha1sum locally against the remote .sha1
3. Verify the serving repository or mirror actually publishes correct checksums (curl the .sha1)
4. Report persistent mismatches to the repository operator; a tampered artifact is a real possibility

Example fix

<!-- before -->
<mirror>
  <id>corp</id>
  <url>https://nexus.example.com/repo</url>
  <mirrorOf>central</mirrorOf>
  <checksumPolicy>warn</checksumPolicy>
</mirror>
<!-- after: fail the build on corrupt downloads -->
<mirror>
  <id>corp</id>
  <url>https://nexus.example.com/repo</url>
  <mirrorOf>central</mirrorOf>
  <checksumPolicy>fail</checksumPolicy>
</mirror>

cd ~/.m2/repository/com/example/artifact/1.0
sha1sum artifact-1.0.jar
cat artifact-1.0.jar.sha1   # the two digests must match; otherwise delete and re-fetch

When it happens

Trigger: checksumPolicy unset or explicitly 'warn' on the repository or mirror in settings.xml, combined with a checksum mismatch during download.

Common situations: Default-policy repositories serving corrupt artifacts; mirrors with stale checksum files; teams unaware that the default silently tolerates tampered downloads.

Related errors

• The groupId cannot be empty.
• Unable to store local copy of metadata: {}
• unknown repository checksum policy: {artifactRepositoryPolic
• Repository list contains duplicate entries. Each repository
• Repository list contains null entries. All repository entrie

AI-assisted analysis of apache/maven@e4093d4e12 (2026-08-21). Data as JSON: /api/errors/082b5dbde79c0ee0. Report an issue: GitHub.