SHA1 mismatch in maven repository
fifth-light opened this issue ยท 9 comments
I am experimenting with building Fabric mods with Bazel, so I configured repositories below:
maven.install(
artifacts = [
"net.fabricmc:fabric-loader:0.16.10",
"net.fabricmc:intermediary:1.21.4:v2",
"net.fabricmc:yarn:1.21.4+build.8:v2",
"net.fabricmc:tiny-remapper:0.11.0",
"net.fabricmc:mapping-io:0.7.1",
"net.fabricmc.fabric-api:fabric-api:0.119.0+1.21.4",
],
repositories = [
"https://maven.fabricmc.net/",
"https://repo1.maven.org/maven2",
],
lock_file = "//:maven_install.json",
)but Bazel give me these errors:
Error fetching artifacts:
...(lots of checksum mismatch)
https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38+3f89f5a504/fabric-loot-api-v2-3.0.38+3f89f5a504.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38%2B3f89f5a504/fabric-loot-api-v2-3.0.38%2B3f89f5a504.jar (expected SHA-1 11be9e015c8e28dbfab7f5622c553e88d2102a2a in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38%2B3f89f5a504/fabric-loot-api-v2-3.0.38%2B3f89f5a504.jar.sha1, got 54f99ac79ad60e5422680f3a1dfd265722938adb)
And I can get two different files with these two links with Firefox (downloading with curl and wget produces same file):
54f99ac79ad60e5422680f3a1dfd265722938adb: https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38+3f89f5a504/fabric-loot-api-v2-3.0.38+3f89f5a504.jar (unescaped)
11be9e015c8e28dbfab7f5622c553e88d2102a2a: https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38%2B3f89f5a504/fabric-loot-api-v2-3.0.38%2B3f89f5a504.jar (escaped)
Here are files downloaded using link above:
fabric-maven-sha1-mismatch.zip
And output of cmp:
$ cmp -l fabric-loot-api-v2-3.0.38+3f89f5a504-escaped.jar fabric-loot-api-v2-3.0.38+3f89f5a504-unescaped.jar
11 171 275
12 162 164
13 160 151
1216 171 275
1217 162 164
1218 160 151
2344 171 275
2345 162 164
2346 160 151
21535 171 275
21536 162 164
21537 160 151
21601 171 275
21602 162 164
21603 160 151
21666 171 275
21667 162 164
21668 160 151
Full error log
Error fetching artifacts: https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-client-tags-api-v1/1.1.29+20ea1e2304/fabric-client-tags-api-v1-1.1.29+20ea1e2304.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-client-tags-api-v1/1.1.29%2B20ea1e2304/fabric-client-tags-api-v1-1.1.29%2B20ea1e2304.jar (expected SHA-1 5875e1e4ecc10c7427d9b2d8d3027b57ed696cac in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-client-tags-api-v1/1.1.29%2B20ea1e2304/fabric-client-tags-api-v1-1.1.29%2B20ea1e2304.jar.sha1, got 8cdc583ecc635efa824d46bd87751d8083041a0a) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-gametest-api-v1/2.0.26+7feeb73304/fabric-gametest-api-v1-2.0.26+7feeb73304.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-gametest-api-v1/2.0.26%2B7feeb73304/fabric-gametest-api-v1-2.0.26%2B7feeb73304.jar (expected SHA-1 316fd320157398d532fc192646a892aa22a89fd1 in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-gametest-api-v1/2.0.26%2B7feeb73304/fabric-gametest-api-v1-2.0.26%2B7feeb73304.jar.sha1, got afde64177b16a431777450934e4c00f147b10d62) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-api-v1/11.3.0+ee91fa1f04/fabric-item-api-v1-11.3.0+ee91fa1f04.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-api-v1/11.3.0%2Bee91fa1f04/fabric-item-api-v1-11.3.0%2Bee91fa1f04.jar (expected SHA-1 cbf488548f5bb35701c3ce473c5b9b4111854eb in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-api-v1/11.3.0%2Bee91fa1f04/fabric-item-api-v1-11.3.0%2Bee91fa1f04.jar.sha1, got 4d08dcae908619dd9d939f2299a994b62a5ab245) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v3/1.0.26+203e6b2304/fabric-loot-api-v3-1.0.26+203e6b2304.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v3/1.0.26%2B203e6b2304/fabric-loot-api-v3-1.0.26%2B203e6b2304.jar (expected SHA-1 3640a564b641f84bf2813fa4c84906192bbf23db in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v3/1.0.26%2B203e6b2304/fabric-loot-api-v3-1.0.26%2B203e6b2304.jar.sha1, got 896f61b75e1e07dc4b095cc31508c100c855aa7f) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-group-api-v1/4.2.2+fcb9601404/fabric-item-group-api-v1-4.2.2+fcb9601404.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-group-api-v1/4.2.2%2Bfcb9601404/fabric-item-group-api-v1-4.2.2%2Bfcb9601404.jar (expected SHA-1 e7d075d5bedcb05bfba7814a2bca6d96dc7b05e9 in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-item-group-api-v1/4.2.2%2Bfcb9601404/fabric-item-group-api-v1-4.2.2%2Bfcb9601404.jar.sha1, got f1aeba755725d72126c1989dc4823d53ac92550b) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-dimensions-v1/4.0.10+7feeb73304/fabric-dimensions-v1-4.0.10+7feeb73304.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-dimensions-v1/4.0.10%2B7feeb73304/fabric-dimensions-v1-4.0.10%2B7feeb73304.jar (expected SHA-1 111e6fa0b1e69ecd327f5f8e52f4492cde3c71f6 in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-dimensions-v1/4.0.10%2B7feeb73304/fabric-dimensions-v1-4.0.10%2B7feeb73304.jar.sha1, got 348cec4a6be1771e1069978dda1ccbaed0a642a2) https://maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38+3f89f5a504/fabric-loot-api-v2-3.0.38+3f89f5a504.jar: wrong checksum: /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38%2B3f89f5a504/fabric-loot-api-v2-3.0.38%2B3f89f5a504.jar (expected SHA-1 11be9e015c8e28dbfab7f5622c553e88d2102a2a in /var/home/.cache/coursier/v1/https/maven.fabricmc.net/net/fabricmc/fabric-api/fabric-loot-api-v2/3.0.38%2B3f89f5a504/fabric-loot-api-v2-3.0.38%2B3f89f5a504.jar.sha1, got 54f99ac79ad60e5422680f3a1dfd265722938adb)
New versions of Fabric API causes cyclic dependency:
(Using net.fabricmc.fabric-api:fabric-api:0.119.0+1.21.5)
$ bazel build @fabazel//mod/src/main:mod --verbose_failures
WARNING: Running Bazel server needs to be killed, because the startup options are different.
Starting local Bazel server (8.1.1) and connecting to it...
DEBUG: /var/home/.cache/bazel/_bazel/b5e60cc5da5a163874a9912e17b21453/external/rules_jvm_external+/private/extensions/maven.bzl:351:18: The maven repository 'maven' has contributions from multiple bzlmod modules, and will be resolved together: ["fabazel", "protobuf"]
ERROR: /var/home/.cache/bazel/_bazel/b5e60cc5da5a163874a9912e17b21453/external/rules_jvm_external++maven+maven/BUILD:1015:11: in jvm_import rule @@rules_jvm_external++maven+maven//:net_fabricmc_fabric_api_fabric_api: cycle in dependency graph:
//mod/src/main:mod (a807b43c07fd2ad95f991746772b57f35d2bcb822e73c58dd9594bd80ce4ee6c)
//mod/src/main:mod (3723722276aac1314320ca9a9fb2a278d80e4eb3b422da8939e984231a537159)
//mod/src/main:mod_unmapped (3723722276aac1314320ca9a9fb2a278d80e4eb3b422da8939e984231a537159)
.-> @@rules_jvm_external++maven+maven//:net_fabricmc_fabric_api_fabric_api (3723722276aac1314320ca9a9fb2a278d80e4eb3b422da8939e984231a537159)
| @@rules_jvm_external++maven+maven//:net_fabricmc_fabric_api_fabric_api_deprecated (3723722276aac1314320ca9a9fb2a278d80e4eb3b422da8939e984231a537159)
`-- @@rules_jvm_external++maven+maven//:net_fabricmc_fabric_api_fabric_api (3723722276aac1314320ca9a9fb2a278d80e4eb3b422da8939e984231a537159)
ERROR: Analysis of target '//mod/src/main:mod' failed; build aborted
INFO: Elapsed time: 9.719s, Critical Path: 0.05s
INFO: 1 process: 1 internal.
ERROR: Build did NOT complete successfully
Solved by exclude net.fabricmc.fabric-api:fabric-api-deprecated manually
I am experimenting with building Fabric mods with Bazel
Oh very intresting! I have had this idea in the back of my mind for a while. Ill be intrested to see how you get on and im happy to help make this work.
Currently when we publish a new release the previous files get overriden, however the jar files have been signed again. Signing the jars is not reproducable.
If I run diff <(unzip -l fabric-loot-api-v2-3.0.38+3f89f5a504-escaped.jar | sort) <(unzip -l fabric-loot-api-v2-3.0.38+3f89f5a504-unescaped.jar | sort) on the files you provided I can seen that the jar signature related files are the only ones that have changed. Gradle handles this just fine, as it uses the hash provided by maven. This has never caused an issue such as this one.
Funny enough yesterday I merged a change into 1.21.5 that skips this republishing for unrealted reasons: #4501 I think this should actually solve your problem going forward.
Ill be intrested to see how you get on and im happy to help make this work.
My progress is here: https://github.com/fifth-light/Fabazel
It can produce loadable JAR, but can't handle remapping dependencies other than Minecraft.
However it's strange for being able to get two different files with same URL (only differ in URL escaping).
I think there are two ways to fix it:
- Delete these duplicated mismatched JAR in the repository
- Make Bazel side to escape URL when downloading (But why Firefox also downloads different files?)
Funny enough yesterday I merged a change into 1.21.5 that skips this republishing for unrealted reasons: #4501 I think this should actually solve your problem going forward.
net.fabricmc.fabric-api:fabric-api:0.119.0+1.21.5 works
New versions of Fabric API causes cyclic dependency:
Made a PR to fix this: #4522 thanks for pointing it out.
Im going to close this as it should now be fixed, please dont heasitate to open a new issue if there is anything else I can help with. I look forward to seeing how you get on using Bazel.