Invalid {sha1 checksum, md5 checksum, signature} for file errors

[joliveraortega]

Hi there!

I updating my publish grade scripts so get ready for the OSSRH sunset. First of all I updated the version of the plugin I am using to version 2.0.0. I have followed info at https://github.com/gradle-nexus/publish-plugin?tab=readme-ov-file#publishing-to-maven-central-via-sonatype-central used the token and password. I am having the following error. I know I should reach Sonatype folks as well but I would like to know if you guys can provide any hint of what's going on here. I understand this is not an issue of the plugin. I am totally lost. Here is the error:

2025-06-30T13:11:08.7772149Z > Task :publishReleasePublicationToSonatypeRepository
2025-06-30T13:11:08.7773006Z Caching disabled for task ':publishReleasePublicationToSonatypeRepository' because:
2025-06-30T13:11:08.7773593Z   Build cache is disabled
2025-06-30T13:11:08.7774161Z Task ':publishReleasePublicationToSonatypeRepository' is not up-to-date because:
2025-06-30T13:11:08.7774954Z   Task has not declared any outputs despite executing actions.
2025-06-30T13:11:08.7776138Z Uploading to https://ossrh-staging-api.central.sonatype.com/service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0
2025-06-30T13:11:08.7777771Z Publishing to repository 'sonatype' (https://ossrh-staging-api.central.sonatype.com/service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0)
2025-06-30T13:11:08.7779562Z Uploading webrtc-121.1.0-dev.447.aar to /service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/121.1.0-dev.447/webrtc-121.1.0-dev.447.aar
2025-06-30T13:11:16.2772782Z Uploading webrtc-121.1.0-dev.447.pom to /service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/121.1.0-dev.447/webrtc-121.1.0-dev.447.pom
2025-06-30T13:11:17.0772486Z Uploading webrtc-121.1.0-dev.447.aar.asc to /service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/121.1.0-dev.447/webrtc-121.1.0-dev.447.aar.asc
2025-06-30T13:11:17.6772714Z Uploading webrtc-121.1.0-dev.447.pom.asc to /service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/121.1.0-dev.447/webrtc-121.1.0-dev.447.pom.asc
2025-06-30T13:11:18.4772236Z Resource missing. [HTTP GET: https://ossrh-staging-api.central.sonatype.com/service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/maven-metadata.xml]
2025-06-30T13:11:18.4774053Z Uploading maven-metadata.xml to /service/local/staging/deployByRepositoryId/***--624b8920-c9e1-4e92-91b5-74147101b9e0/com/vonage/webrtc/maven-metadata.xml
2025-06-30T13:11:18.9771822Z :publishReleasePublicationToSonatypeRepository (Thread[Daemon worker,5,main]) completed. Took 12.217 secs.
2025-06-30T13:11:18.9772675Z :closeSonatypeStagingRepository (Thread[Daemon worker,5,main]) started.
2025-06-30T13:11:20.9770804Z 
2025-06-30T13:11:20.9771063Z > Task :closeSonatypeStagingRepository
2025-06-30T13:11:20.9771730Z Caching disabled for task ':closeSonatypeStagingRepository' because:
2025-06-30T13:11:20.9772233Z   Build cache is disabled
2025-06-30T13:11:20.9772723Z Task ':closeSonatypeStagingRepository' is not up-to-date because:
2025-06-30T13:11:20.9773311Z   Task has not declared any outputs despite executing actions.
2025-06-30T13:11:20.9774076Z Closing staging repository with id '***--624b8920-c9e1-4e92-91b5-74147101b9e0'
2025-06-30T13:11:36.8771410Z 
2025-06-30T13:11:36.8771856Z > Task :closeSonatypeStagingRepository FAILED
2025-06-30T13:11:36.8772601Z :closeSonatypeStagingRepository (Thread[Daemon worker,5,main]) completed. Took 17.916 secs.
2025-06-30T13:11:36.8773107Z 
2025-06-30T13:11:36.8773252Z FAILURE: Build failed with an exception.
2025-06-30T13:11:36.8773506Z 
2025-06-30T13:11:36.8773610Z * What went wrong:
2025-06-30T13:11:36.8774108Z Execution failed for task ':closeSonatypeStagingRepository'.
2025-06-30T13:11:36.8775695Z > Failed to close staging repository, server at https://ossrh-staging-api.central.sonatype.com/service/local/ responded with status code 400, body: Failed to process request: Deployment reached an unexpected status: Failed
2025-06-30T13:11:36.8776925Z   pkg:maven/com.vonage/webrtc@121.1.0-dev.447?type=aar
2025-06-30T13:11:36.8777489Z   - Invalid sha1 checksum for file: webrtc-121.1.0-dev.447.aar
2025-06-30T13:11:36.8778076Z   - Invalid md5 checksum for file: webrtc-121.1.0-dev.447.aar
2025-06-30T13:11:36.8778658Z   - Invalid signature for file: webrtc-121.1.0-dev.447.aar.asc
2025-06-30T13:11:36.8778986Z 
2025-06-30T13:11:36.8779073Z * Try:
2025-06-30T13:11:36.8779804Z Run with --stacktrace option to get the stack trace. Run with --debug option to get more log output. Run with --scan to get full insights.

What could cause checksums or the signature are invalid here?

Any hint is appreciated. Thanks in advance.

[szpak]

This plugin has nothing to do with file upload - the native Gradle maven-publish does it. If you hasn't changed anything there (I'm not sure if Gradle generates checksums 🤔 ), it might be some glitches with Sonatype.

Invalid signature for file: webrtc-121.1.0-dev.447.aar.asc

This is weird as Sonatype should not expect recursive signature for the signature itself...