Clojurians Log v2

Hey. I’ve been deploying to clojars for years. This morning I’m getting:

Uploaded to clojars:  (146 kB at 65 kB/s)
Downloading from clojars: 
Downloaded from clojars:  (6.7 kB at 28 kB/s)
Uploading to clojars: 
Uploaded to clojars:  (1.1 kB at 610 B/s)
Uploading to clojars: 
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  9.102 s
[INFO] Finished at: 2023-04-11T12:02:09-07:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:3.1.0:deploy (default-deploy) on project fulcro-rad: Failed to deploy metadata: Could not transfer metadata com.fulcrologic:fulcro-rad/maven-metadata.xml from/to clojars (): status code: 403, reason phrase: Forbidden - no checksums provided for fulcro-rad-1.4.9-20230411.190200-1.pom.asc (403) -> [Help 1]

it can write the files, but the checksums are failing…ideas?

ah…seems like others are having this issue..I’ll read earlier thread 🙂

seems like signing stopped working? I’ve been signing my artifacts forever (and yes my public key is published in the GPG ecosystem). It seems so odd to not sign artifacts to me, and this is a regression. I’ve uploaded signed stuff for literally my entire existence as an OSS developer.

it does work if I turn off signing 😞

Hi @tony.kay! Nothing has changed on the Clojars side in years, but based on the other thread, it sounds like maven/aether stopped providing checksum files for signatures in a recent release. There's a workaround in that thread for a sysprop to turn it back on, but if the maven folks don't care about checksums for signature files, maybe clojars shouldn't either?

Ah!

Yes, I did update maven last night, I forgot!

I don’t see why you’d ever care about a checksum on a signature…the signature is already a proof. It the checksum is wrong the proof will fail, and ppl will consider it a bad release (if they care to check)

could you point me to the thread?

this is going to affect all 16+ of my OSS projects 😕

That's a good point. When I implemented the validation, all tools sent checksums with the signatures (along with checksums for all files), so the validation was "if you send a checksum, you have to send a checksum for everything". But that no longer makes sense.

To enable them again, you have to set aether.checksums.omitChecksumsForExtensions explicitly to an empty string (`""`)

ok, thanks

Based on discussion here https://github.com/slipset/deps-deploy/pull/53, linked from this thread: https://clojurians.slack.com/archives/C0H28NMAS/p1679955780176239 (no need to read that thread, just linking for completeness)

I created https://github.com/clojars/clojars-web/issues/859 to fix this, but I'm not sure when I'll be able to get to it.

For those using raw maven, here is the fix: Edit your ~/.m2/settings.xml, and add this section:

<settings>
  ...

  <profiles>
    <profile>
      <id>checksums</id>
      <activation>
        <activeByDefault>true</activeByDefault>
      </activation>
      <properties>
        <aether.checksums.omitChecksumsForExtensions></aether.checksums.omitChecksumsForExtensions>
      </properties>
    </profile>
  </profiles>

  <activeProfiles>
    <activeProfile>checksums</activeProfile>
  </activeProfiles>
</settings>

I just retried my deploy of a snapshot and it works again. Thanks @tcrawley