Invalid SHA1 during Ivy retrieve

[joel-bernstein]

I noticed the following warnings while retrieving the 0.107 Presto Parser:

ivy:retrieve] :::: WARNINGS
[ivy:retrieve] problem while downloading module descriptor: http://repo1.maven.org/maven2/com/facebook/presto/presto-parser/0.107/presto-parser-0.107.pom: invalid sha1: expected=7f2f854a24db4cc9b5c26c3e9c6e46da37abbed1 computed=661fee4927f5b356f91880c308e5bf586568ff3c (180ms)
[ivy:retrieve] problem while downloading module descriptor: http://repo1.maven.org/maven2/com/facebook/presto/presto-root/0.107/presto-root-0.107.pom: invalid sha1: expected=3e2a2729fd8b728fdc29c4062f5dc9a138c433cd computed=2cdf6c93caab02a26e6280862ed25452b862e5bf (218ms)
[ivy:retrie

[electrum]

@jvanzyl any ideas how this could happen? They definitely do not match:

$ curl -sS http://repo1.maven.org/maven2/com/facebook/presto/presto-parser/0.107/presto-parser-0.107.pom | shasum
661fee4927f5b356f91880c308e5bf586568ff3c  -

$ curl -sS http://repo1.maven.org/maven2/com/facebook/presto/presto-parser/0.107/presto-parser-0.107.pom.sha1
7f2f854a24db4cc9b5c26c3e9c6e46da37abbed1

[jvanzyl]

Without checking anything yet, did you try to release this a couple times and try to drop the staging repository in Nexus? I'll look at some other releases but if this is generally the case that's bad because it's probably the Maven Release Plugin. If you had to release/drop/release with Nexus it would not surprise me if it just left the old bits around.

[dain]

Isn't this something that is checked for when closing a staging repository?

[jvanzyl]

It is, but if there were multiple attempts to release and a repo was dropped it's possible a file got picked up from a dropped repo. I'm running a check on all of central now.

[electrum]

I'm going to this since it's for a very old version and is a problem with Maven Central: http://central.sonatype.org/

We deploy to Central via the standard OSSRH process, which should have checks in place to prevent this from occuring (but apparently something went wrong this release): http://central.sonatype.org/pages/releasing-the-deployment.html