{"record":{"id":"082b5dbde79c0ee0","repo":"apache/maven","slug":"the-type-cannot-be-empty","errorCode":null,"errorMessage":"The type cannot be empty.","messagePattern":"The type cannot be empty\\.","errorType":"validation","errorClass":"InvalidArtifactRTException","httpStatus":null,"severity":"warning","filePath":"compat/maven-artifact/src/main/java/org/apache/maven/artifact/DefaultArtifact.java","lineNumber":177,"sourceCode":"\n        this.optional = optional;\n\n        validateIdentity();\n    }\n\n    private void validateIdentity() {\n        if (empty(groupId)) {\n            throw new InvalidArtifactRTException(\n                    groupId, artifactId, getVersion(), type, \"The groupId cannot be empty.\");\n        }\n\n        if (empty(artifactId)) {\n            throw new InvalidArtifactRTException(\n                    groupId, artifactId, getVersion(), type, \"The artifactId cannot be empty.\");\n        }\n\n        if (empty(type)) {\n            throw new InvalidArtifactRTException(groupId, artifactId, getVersion(), type, \"The type cannot be empty.\");\n        }\n\n        if ((empty(version)) && (versionRange == null)) {\n            throw new InvalidArtifactRTException(\n                    groupId, artifactId, getVersion(), type, \"The version cannot be empty.\");\n        }\n    }\n\n    public static boolean empty(String value) {\n        return value == null || value.isBlank();\n    }\n\n    @Override\n    public String getClassifier() {\n        return classifier;\n    }\n\n    @Override","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/apache/maven/blob/e4093d4e120eac99d6bdce5ba67cace2f3085c97/compat/maven-artifact/src/main/java/org/apache/maven/artifact/DefaultArtifact.java#L159-L195","documentation":"Checksum verification failed and the repository's checksumPolicy resolved to 'warn' (anything other than fail or ignore): handleChecksumFailure logs this warning and keeps the downloaded artifact, so the build succeeds with a file whose integrity was not proven.","triggerScenarios":"checksumPolicy unset or explicitly 'warn' on the repository or mirror in settings.xml, combined with a checksum mismatch during download.","commonSituations":"Default-policy repositories serving corrupt artifacts; mirrors with stale checksum files; teams unaware that the default silently tolerates tampered downloads.","solutions":["If integrity matters, set <checksumPolicy>fail</checksumPolicy> on the repository or mirror in settings.xml","Delete the artifact from the local repository and re-fetch with -U; compare sha1sum locally against the remote .sha1","Verify the serving repository or mirror actually publishes correct checksums (curl the .sha1)","Report persistent mismatches to the repository operator; a tampered artifact is a real possibility"],"exampleFix":"<!-- before -->\n<mirror>\n  <id>corp</id>\n  <url>https://nexus.example.com/repo</url>\n  <mirrorOf>central</mirrorOf>\n  <checksumPolicy>warn</checksumPolicy>\n</mirror>\n<!-- after: fail the build on corrupt downloads -->\n<mirror>\n  <id>corp</id>\n  <url>https://nexus.example.com/repo</url>\n  <mirrorOf>central</mirrorOf>\n  <checksumPolicy>fail</checksumPolicy>\n</mirror>","handlingStrategy":"validation","validationCode":"cd ~/.m2/repository/com/example/artifact/1.0\nsha1sum artifact-1.0.jar\ncat artifact-1.0.jar.sha1   # the two digests must match; otherwise delete and re-fetch","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set checksumPolicy=fail on repositories used by CI","Compare the remote .sha1 with curl before trusting a suspicious artifact","Delete and re-fetch any artifact that produced this warning"],"tags":["maven","checksum","integrity","repository-policy","maven-compat"],"backgroundTag":"checksum-mismatch","analyzedSha":"e4093d4e120eac99d6bdce5ba67cace2f3085c97","analyzedAt":"2026-08-21T22:58:24.034Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}