title: How do I fix incorrect checksums in my Nexus repository?
body: <p>Some of the artifacts in my local Nexus repository don't have the correct checksum.  For example (wrong checksum):</p>
  
  <blockquote>
    <p>cat central/org/codehaus/plexus/plexus-compiler-api/1.8/plexus-compiler-api-1.8.pom.sha1
    95f3332c2bbace129da501424f297e47dd0e976b</p>
  </blockquote>
  
  <p>vs (correct checksum):</p>
  
  <blockquote>
    <p>sha1sum central/org/codehaus/plexus/plexus-compiler-api/1.8/plexus-compiler-api-1.8.pom
    4c2947f7e2d09b6e13da34292d897c564f1f9828</p>
  </blockquote>
  
  <p>It looks like I have a few artifacts in my repository that were downloaded when <a href="http://jira.codehaus.org/browse/MNG-4235" rel="nofollow">this bug</a> was active.</p>
  
  <p>Maven Central has the correct checksum (4c29...) now, but the checksums in my local Nexus repository remain stale.  I don't know how to get my local repository to verify and / or re-download the correct checksum from central.</p>
  
  <p>What is the correct way of fixing my local repository.  There aren't too many artifacts with this problem, so I think I could (by hand) verify they still exist in central and delete them from my local repository.  They should get re-cached with the correct checksums.  Is there a better way?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I've looked at this more and I'm almost positive I know what the source of my problem is.  One of the artifacts I'm having trouble with is this one (<a href="http://search.maven.org/#browse%7C-516141671" rel="nofollow">plexus-compiler-api:1.8</a>):</p>
  
  <p>In my repository, both the .pom and .pom.sha1 are timestamped as 29-Mar-2010.  At central, the .pom is timestamped as 29-Mar-2010 while the .pom.sha1 is timestamped as 21-Apr-2010.  I was reading about <a href="http://www.sonatype.com/people/2009/09/nexus-scheduled-tasks/" rel="nofollow">Nexus maintenance</a>. I assume that, on 21-Apr-2010, Maven Central rebuilt metadata and verified checksums which fixed the incorrect .sha1 for the plexus-compiler-api:1.8 artifact.</p>
  
  <p>According to the Sonatype link above, I should be able to expire the caches for Maven Central and have my local installation pull new copies of anything with newer timestamps than the originally cached artifacts.  However, based on the behavior I've observed, I think it's only checking timestamps for artifact files, not checksum files.</p>
  
  <p>As far as my local Nexus repository is concerned, I have the most recent version of the artifact (29-Mar-2010), so there's no need to re-download anything.</p>
  
  <p>I've noticed my version of Nexus is quite old (1.5 vs 1.9.1), so I'll try updating and see if the newer version does a better job of expiring caches.  If not, I'll probably see what the Sonatype guys think (maybe it's a bug?).</p>