apache/maven · warning · RepositoryMetadataResolutionException

Unable to store local copy of metadata

Error message

Unable to store local copy of metadata: {}

What it means

Slf4jMavenTransferListener.transferCorrupted fires when the resolver reports a corrupted transfer (checksum mismatch observed during a download). The warning shows the underlying exception message plus the repository id, URL, and resource path; the download itself subsequently fails or is retried according to the repository checksum policy.

Solutions

1. Delete the partially downloaded artifact directory from the local repository and retry with -U
2. Compare checksums manually to see which side is wrong: sha1sum of the local file versus the remote .sha1 fetched with curl
3. Switch to a healthy mirror of Central if the repository keeps serving corrupt files
4. Set checksumPolicy=fail to turn silent corruption into an explicit build error

Example fix

# before
mvn clean install   # warns during download: Checksum failed ... from central
# after
clean=$(find ~/.m2/repository -path '*com/example/artifact/1.0' -type d); rm -rf $clean
mvn -U clean install

dir=~/.m2/repository/com/example/artifact/1.0
current=$(sha1sum $dir/artifact-1.0.jar 2>/dev/null | cut -d' ' -f1)
expected=$(cat $dir/artifact-1.0.jar.sha1 2>/dev/null)
[ "$current" = "$expected" ] || rm -rf $dir   # force clean re-download

When it happens

Trigger: Checksum verification failure while downloading, surfaced through the default CLI logging (visible when progress output is enabled, hidden by --no-transfer-progress).

Common situations: Mirrors or proxies serving truncated files; local repository holding a partial download; repositories with stale .sha1/.md5 files.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• The groupId cannot be empty.
• The type cannot be empty.
• could not be retrieved from repository: due to an error
• Error updating group repository metadata
• Failed to retrieve POM for " + artifact.getId() + ": " +…

AI-assisted analysis of apache/maven@e4093d4e12 (2026-08-21). Data as JSON: /api/errors/a4ce5ac3c9404667. Report an issue: GitHub.

Appendix: source

Thrown at compat/maven-compat/src/main/java/org/apache/maven/artifact/repository/metadata/DefaultRepositoryMetadataManager.java:157

                                        + " due to an error: " + e.getMessage());
                        getLogger().debug("Exception", e);
                    } finally {
                        updateCheckManager.touch(metadata, repository, file);
                    }
                }

                // TODO should this be inside the above check?
                // touch file so that this is not checked again until interval has passed
                if (file.exists()) {
                    file.setLastModified(System.currentTimeMillis());
                }
            }
        }

        try {
            mergeMetadata(metadata, remoteRepositories, localRepo);
        } catch (RepositoryMetadataStoreException e) {
            throw new RepositoryMetadataResolutionException(
                    "Unable to store local copy of metadata: " + e.getMessage(), e);
        }
    }

    private Date getLocalCopyLastModified(ArtifactRepository localRepository, RepositoryMetadata metadata) {
        String metadataPath = localRepository.pathOfLocalRepositoryMetadata(metadata, localRepository);
        File metadataFile = new File(localRepository.getBasedir(), metadataPath);
        return metadataFile.isFile() ? new Date(metadataFile.lastModified()) : null;
    }

    private void mergeMetadata(
            RepositoryMetadata metadata,
            List<ArtifactRepository> remoteRepositories,
            ArtifactRepository localRepository)
            throws RepositoryMetadataStoreException {
        // TODO currently this is first wins, but really we should take the latest by comparing either the
        // snapshot timestamp, or some other timestamp later encoded into the metadata.
        // TODO this needs to be repeated here so the merging doesn't interfere with the written metadata

View on GitHub (pinned to e4093d4e12)