PaperMC snapshots repository returns corrupt artifacts

[A248]

Expected behavior

PaperMC's repositories, maven-public, maven-releases, and maven-snapshots return, or redirect to a page that returns, HTTP code 404 when the artifact is not found.

Observed/Actual behavior

The maven-snapshots repository returns 200 status codes for some artifacts that weren't found. This can cause Maven builds to fail with strange messages like "zip END header not found."

The behavior is thoroughly describable:

1. The repository returns HTTP 302 (redirect)
2. The redirect URL returns HTTP 200 (ok)
3. Maven follows the redirect URL, reads the 200 status code, and treats the page as a jar and downloads it.
4. Paper's JFrog Artifactory software therefore returns corrupt artifact data. Maven consumes this data, stumbles, and dies.

This is evidenced by log lines like this:

[WARNING] Could not validate integrity of download from https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar: Checksum validation failed, no checksums available
[WARNING] Checksum validation failed, no checksums available from papermc-snapshots for https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar
Downloaded from papermc-snapshots: https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar (17 kB at 41 kB/s)

Clearly, adventure-api 5.1.0 is NOT 17 KB. That would be silly. However, this is the result of PaperMC's repository returning status code 200 despite the artifact being missing.

Steps/models to reproduce

1. Use the maven-snapshots repository.
2. Pick an artifact which doesn't come from that repository, e.g. adventure-api 5.1.0.
3. Run curl -I https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar. Get HTTP status 302.
4. Run another curl on the redirect URL. curl -I https://artifactory.papermc.io/ui/native/snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar.
5. Result is HTTP status code 200, but actual document is clearly not a jar!

The artifactory page is in fact:

{
  "errors": [
    {
      "status": 404,
      "message": "Item snapshots:net/kyori/adventure-api/5.1.0 does not exist"
    }
  ]
}

Which is not valid jar data.

Plugin and Datapack List

NA

Paper version

NA

Other

Full log can be seen here: https://pastebin.com/FQNpBq2D

[MiniDigger]

I can't repro? resolving a release jar from the snapshots repo returns a 4xx as expected:

curl -i https://repo.papermc.io/repository/maven-snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar
HTTP/1.1 409 Conflict
Date: Fri, 26 Jun 2026 06:02:24 GMT
Content-Type: application/json;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
x-artifactory-id: 4317845041410be6:-204cc1ee:19efce37a28:-8000
x-artifactory-node-id: 80dbeb89b5df
x-jfrog-version: Artifactory/7.117.17 81717900
X-Content-Type-Options: nosniff
Vary: accept-encoding
cf-cache-status: BYPASS
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Server: cloudflare
CF-RAY: a11a00bf7961f954-DUS
alt-svc: h3=":443"; ma=86400

{
  "errors" : [ {
    "status" : 409,
    "message" : "The repository 'snapshots' rejected the resolution of an artifact 'snapshots:net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar' due to conflict in the snapshot release handling policy.; Path: 'snapshots:net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar'"
  } ]
}

why are you even picking the maven snapshots repo? all our docs suggest to use the maven-public one.
not sure why that is even allowed by the public, these repos only exist for our own consumption (well, publishing) and should never be fetched directly. Ill look into disabling this access.

[A248]

Possibly because you waited too long and/or the Cloudflare caching policies have changed for these URLs. I get the same 409 response if I visit the URL for that artifact (which by the way, is a 409 even correct?). However, there is plenty of evidence for this behavior:

1. The proxied URL https://artifactory.papermc.io/ui/native/snapshots/net/kyori/adventure-api/5.1.0/adventure-api-5.1.0.jar is still returning 200 status code plus the JSON I posted above. I am sure you can check your infrastructure and see that, behind Cloudflare caching, this is where your URLs go. You seem to have two layers of Cloudflare caching, one for each subdomain.
2. View the log I posted above. Maven clearly downloads a corrupt artifact from the PaperMC repository, and the cause was confirmed by curl.
3. This happens for the PaperMC repositories, and it happens sporadically. It has also happened for maven-public based on a Github Actions build I have. Again, same symptoms, similar corrupt download.

Lastly, why would the snapshots repository be disabled? If you do that, then no repository will exist that returns PaperMC artifacts which doesn't also proxy Maven Central. I am using this repository precisely because I don't want my central artifacts to be served by your webservers.

[kashike]

As per the PaperMC community guidelines, political discussions are not permitted here. This is your only warning.

[A248]

I haven't engaged in any political discussions. Ban me if you wish.

[dubsector]

I've noticed odd behavior as well when using the api as well, but for Velocity.

[Zoriot]

IDK why but somehow there is a weird guava version in papermc repo.
https://repo.papermc.io/repository/maven-public/com/google/guava/guava/999.0.0-HEAD-jre-SNAPSHOT/guava-999.0.0-HEAD-jre-20260701.164618-384.jar. In maven central I cannot find that version.
I use https://github.com/littlerobots/version-catalog-update-plugin/ for seeing which dependencies needs an update and there this was recommended to me.