Repository navigation
PaperMC snapshots repository returns corrupt artifacts #13987
Description
Expected behavior
PaperMC's repositories, maven-public, maven-releases, and maven-snapshots return, or redirect to a page that returns, HTTP code 404 when the artifact is not found.
Observed/Actual behavior
The maven-snapshots repository returns 200 status codes for some artifacts that weren't found. This can cause Maven builds to fail with strange messages like "zip END header not found."
The behavior is thoroughly describable:
- The repository returns HTTP 302 (redirect)
- The redirect URL returns HTTP 200 (ok)
- Maven follows the redirect URL, reads the 200 status code, and treats the page as a jar and downloads it.
- Paper's JFrog Artifactory software therefore returns corrupt artifact data. Maven consumes this data, stumbles, and dies.
This is evidenced by log lines like this:
[WARNING] Could not validate integrity of download from https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar: Checksum validation failed, no checksums available
[WARNING] Checksum validation failed, no checksums available from papermc-snapshots for https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar
Downloaded from papermc-snapshots: https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar (17 kB at 41 kB/s)
Clearly, adventure-api 5.1.0 is NOT 17 KB. That would be silly. However, this is the result of PaperMC's repository returning status code 200 despite the artifact being missing.
Steps/models to reproduce
- Use the
maven-snapshotsrepository. - Pick an artifact which doesn't come from that repository, e.g. adventure-api 5.1.0.
- Run
curl -I https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar. Get HTTP status 302. - Run another curl on the redirect URL.
curl -I https://artifactory.papermc.io/ui/native/snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar. - Result is HTTP status code 200, but actual document is clearly not a jar!
The artifactory page is in fact:
{
"errors": [
{
"status": 404,
"message": "Item snapshots:net/kyori/adventure-api/5.1.0 does not exist"
}
]
}
Which is not valid jar data.
Plugin and Datapack List
NA
Paper version
NA
Other
Full log can be seen here: https://pastebin.com/FQNpBq2D
Activity
MiniDigger commentedon Jun 26, 2026
I can't repro? resolving a release jar from the snapshots repo returns a 4xx as expected:
why are you even picking the maven snapshots repo? all our docs suggest to use the maven-public one.
not sure why that is even allowed by the public, these repos only exist for our own consumption (well, publishing) and should never be fetched directly. Ill look into disabling this access.
A248 commentedon Jun 26, 2026
Possibly because you waited too long and/or the Cloudflare caching policies have changed for these URLs. I get the same 409 response if I visit the URL for that artifact (which by the way, is a 409 even correct?). However, there is plenty of evidence for this behavior:
https://artifactory.papermc.io/ui/native/snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jaris still returning 200 status code plus the JSON I posted above. I am sure you can check your infrastructure and see that, behind Cloudflare caching, this is where your URLs go. You seem to have two layers of Cloudflare caching, one for each subdomain.Lastly, why would the snapshots repository be disabled? If you do that, then no repository will exist that returns PaperMC artifacts which doesn't also proxy Maven Central. I am using this repository precisely because I don't want my central artifacts to be served by your webservers.
kashike commentedon Jun 26, 2026
As per the PaperMC community guidelines, political discussions are not permitted here. This is your only warning.
A248 commentedon Jun 26, 2026
I haven't engaged in any political discussions. Ban me if you wish.
dubsector commentedon Jun 29, 2026
I've noticed odd behavior as well when using the api as well, but for Velocity.
Zoriot commentedon Jul 6, 2026
IDK why but somehow there is a weird guava version in papermc repo.
https://repo.papermc.io/repository/maven-public/com/google/guava/guava/999.0.0-HEAD-jre-SNAPSHOT/guava-999.0.0-HEAD-jre-20260701.164618-384.jar. In maven central I cannot find that version.I use https://github.com/littlerobots/version-catalog-update-plugin/ for seeing which dependencies needs an update and there this was recommended to me.
Warriorrrr commentedon Oct 19, 2026
One of the repositories maven-public mirrors is central snapshots, that artifact is from there. You should ideally configure that plugin to not recommend you snapshot versions of dependencies as it seems to mention in its readme.
This issue itself will be closed now given that it's still a can't reproduce.