# Plugins.gradle.org serving incorrect pom

**URL:** <https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161>\
**Category:** Plugin Portal\
**Created:** [November 1, 2022, 5:29pm UTC](https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161 "2022-11-01T17:29:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chriswarbo](https://avatars.discourse-cdn.com/v4/letter/c/838e76/32.png) [@chriswarbo](https://discuss.gradle.org/u/chriswarbo)\
**Post date:** [November 1, 2022, 5:29pm UTC](https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161/1 "2022-11-01T17:29:58Z")

</div>

Hello, I’ve not really used Gradle myself, but I use a tool (gtfsvtor) which uses Gradle, and its build has just stopped working. This seems to be due to this file being incorrect: [https://plugins.gradle.org/m2/com/fasterxml/jackson/core/jackson-annotations/2.13.0/jackson-annotations-2.13.0.pom](https://plugins.gradle.org/m2/com/fasterxml/jackson/core/jackson-annotations/2.13.0/jackson-annotations-2.13.0.pom)

In particular, it should have the SHA256 d74619b062d06e01928e365291ec26d05455783796c1085f03cc7723340f5573 (this appears in our lock files, and matches the contents served by [https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.13.0/jackson-annotations-2.13.0.pom](https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.13.0/jackson-annotations-2.13.0.pom) ); but it’s currently serving a file with the hash c4ec8228d74f9d9cefe11ebae9f69137479edef6277589453db374d08f1c5162

Diffing the two, it looks like the one served from [plugins.gradle.org](http://plugins.gradle.org) is using Windows line-endings, and is missing this section:

```gradle
  <repositories>
    <repository>
      <id>sonatype-nexus-snapshots</id>
      <name>Sonatype Nexus Snapshots</name>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
      <releases><enabled>false</enabled></releases>
      <snapshots><enabled>true</enabled></snapshots>
    </repository>
  </repositories>

```

Any idea why this might have changed? The CI job which spotted this was last run 4 days ago, and was successful (it runs without any caches, so definitely fetched the same URL)

---

<div class="post-metadata">

**Author:** ![chriswarbo](https://avatars.discourse-cdn.com/v4/letter/c/838e76/32.png) [@chriswarbo](https://discuss.gradle.org/u/chriswarbo)\
**Post date:** [November 1, 2022, 5:54pm UTC](https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161/2 "2022-11-01T17:54:59Z")

</div>

Here’s the lock file which no longer matches (it’s actually the gradle2nix tool which fails to build; we use that to build gtfsvtor with Nix) [gradle2nix/gradle-env.json at 3f9d3cb01ab32d0514844d2f3efc0cea85278cf4 · Zipabout/gradle2nix · GitHub](https://github.com/Zipabout/gradle2nix/blob/3f9d3cb01ab32d0514844d2f3efc0cea85278cf4/gradle-env.json#L106)

That file was last changed in December 2021 (not by us; we just keep a fork in case upstream disappears), and has been working until 4 days ago.

---

<div class="post-metadata">

**Author:** ![Vampire](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/vampire/32/9082_2.png) [@Vampire](https://discuss.gradle.org/u/Vampire)\
**Post date:** [November 1, 2022, 7:05pm UTC](https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161/3 "2022-11-01T19:05:27Z")

</div>

Try running with `--refresh-dependencies`. At least for me it gives the SHA256 you exepect.  
Could maybe be related to the JCenter outage where Gradle temporarily switched to a JCenter mirror, maybe that delivered the file differently.

---

<div class="post-metadata">

**Author:** ![chriswarbo](https://avatars.discourse-cdn.com/v4/letter/c/838e76/32.png) [@chriswarbo](https://discuss.gradle.org/u/chriswarbo)\
**Post date:** [November 1, 2022, 9:38pm UTC](https://discuss.gradle.org/t/plugins-gradle-org-serving-incorrect-pom/44161/4 "2022-11-01T21:38:00Z")

</div>

Hmm, it was still giving different results (confirmed with both wget and curl); but now seems to have sorted itself out, and every tool’s giving me the correct content again. Probably related to the JCenter outage as you say.