Fixing Yum Indexing on Sonatype Nexus and the Non-Open-Source Upgrade

A Sonatype Nexus user reported that upgrading the container from sonatype/nexus3:3.76.0-java17-ubi to the latest version broke RPM build pipelines with sha256 checksum mismatch errors and also moved the installation from the open-source artifact repository to closed proprietary commercial software with no downgrade path. The user fixed the checksum failures by rebuilding the Yum package indexes, then had to extract all artifacts, rebuild an older Nexus installation, and reupload every package to return to the open-source version. The user now plans to build a custom pipeline to keep receiving updates for the open-source Nexus release.

Fixing Yum Indexing on Sonatype Nexus and the Non-Open-Source Upgrade I’ve been using Sonatype Nexus for the past few months as a repository for build artifacts Python and RPM packages for project I’ve been developing. Recently several of my build pipelines broke with RPM checksum errors. Doing some searches, I only found old, unanswered forum questions and absolutely useless AI-generated answers. Upgrading to the latest version of Nexus didn’t solve the issue either. After looking through some documentation, I did discover how to rebuild the package indexes and fix my issue. However, I didn’t realize the Nexus upgrade shifted me from a truly open-source artifact repository to closed proprietary commercial software with no way to downgrade back to the open-source version. This was infuriating. Now, even though my problem was fixed, I had to extract all my artifacts, rebuild an older Nexus installation and then reupload all my package. I’ll also have to create my own build pipeline if I want to continue getting updates for the open source-version of Nexus. The Original Problem I started to get errors in my build pipeline that took the form Downloading successful, but checksum doesn't match. Calculated: xxx sha256 Expected: yyy . Searching for this error yielded very few results. I discovered a form post from five years ago where someone had the same issue, but there were no replies<sup 1 fn:1 </sup . BattlePenguin Fedora 42 Unstable 100% | 1.1 KiB/s | 1.6 KiB | 00m01s } Librepo error: repomd.xml GPG signature verification error: Signing key not found Fedora 42 - x86 64 - Updates 100% | 1.9 MiB/s | 4.4 MiB | 00m02s https://nexus.sumit.im/repository/public-keys/RPM-GPG-KEY-battlepenguin 100% | 1.7 KiB/s | 677.0 B | 00m00s Importing OpenPGP key 0x5452534A: UserID : " <sumit@penguindreams.org " Fingerprint: 30224325F56E8F327A961DB2C421BAF25452534A From : https://nexus.sumit.im/repository/public-keys/RPM-GPG-KEY-battlepenguin The key was successfully imported. BattlePenguin Fedora 42 Unstable 100% | 14.2 KiB/s | 33.7 KiB | 00m02s Downloading successful, but checksum doesn't match. Calculated: 7be73e822a35e6cde7ff71d6d25ee1e3b0e9d2d0ec3929e58a6fec7beac013f6 sha256 Expected: 0a1156aa33e617b2f42f4e2a8b994c8b3487dfc84a89b84fc685d32a9ffd9325 sha256 - https://n Downloading successful, but checksum doesn't match. Calculated: 7be73e822a35e6cde7ff71d6d25ee1e3b0e9d2d0ec3929e58a6fec7beac013f6 sha256 Expected: 0a1156aa33e617b2f42f4e2a8b994c8b3487dfc84a89b84fc685d32a9ffd9325 sha256 - https://n Downloading successful, but checksum doesn't match. Calculated: 7be73e822a35e6cde7ff71d6d25ee1e3b0e9d2d0ec3929e58a6fec7beac013f6 sha256 Expected: 0a1156aa33e617b2f42f4e2a8b994c8b3487dfc84a89b84fc685d32a9ffd9325 sha256 - https://n Downloading successful, but checksum doesn't match. Calculated: 7be73e822a35e6cde7ff71d6d25ee1e3b0e9d2d0ec3929e58a6fec7beac013f6 sha256 Expected: 0a1156aa33e617b2f42f4e2a8b994c8b3487dfc84a89b84fc685d32a9ffd9325 sha256 - https://n Librepo error: Yum repo downloading error: Downloading error s : repodata/0a1156aa33e617b2f42f4e2a8b994c8b3487dfc84a89b84fc685d32a9ffd9325-primary.xml.gz - Cannot download, all mirrors were already tried without success Repositories loaded. Failed to resolve the transaction: I first made the mistake of updating my Nexus container from sonatype/nexus3:3.76.0-java17-ubi to sonatype/nexus3:3.82.0-java17-ubi . I’ll explain why this was a mistake later, but it did not fix the issue. Some more searching led to a support article from an older version of Nexus on how to rebuild the RPM indexes for Yum repositories<sup 2 fn:2 </sup . Although some of the page locations from the article had changed, I was able to find the relevant settings and create a set of tasks for rebuilding the metadata on all my Yum repositories. After running these tasks, my build pipelines were now able to pull RPM packages correctly from the repository. Sonatype’s Slight of Hand and Dropping Open Source However, during the upgrade process, I clicked through an agreement without noticing I was being moved away from the Free and Open Source version of Nexus to a Community Edition , which was closed source and had usage limits. It turns out, upgrading to version 3.77 or above moved users to the closed-source, proprietary Community Edition<sup 3 fn:3 </sup . The entire way Sonatype pushed the update is very shady. People in corporate environments were suddenly struck with this change, pushing them towards an expensive pro license they might not be able to afford<sup 4 fn:4 </sup . I had forgotten to place the volumes for my Nexus container in my regular backup. Sonatype does not support rolling back releases of their software, recommending people restore from backups instead<sup 5 fn:5 </sup . I’m glad I’m just using Nexus for my personal projects. This type of upgrade mistake, without viable backups to restore from, could easily be career-ending in a corporate environment. Using Claude Code to Pull and Restore Sonatype Artifacts I’ve only written briefly about large language models LLMs and the limited use I’ve found for them in software engineering. I have been fairly unimpressed by AI coding tools in the past. Yet with friends who continually swear by them, I’ve started to experiment with newer models. The chats integrated into my code editor have helped provide solutions for difficult problems I could not find answers for in documentation or forum posts. However, the code still wasn’t entirely correct and required some debugging. I’ve been told about the benefits of using AI tools that work on your entire codebase and decided this would be a good time to try out Claude Code for extracting all my artifacts from Sonatype Nexus and publishing them to a previous release of the software. Using the command line tools and a detailed prompt, Claude Code created a task list and started a series of generations. Some of the implementation choices it made were not great, but it allowed modification prompts before writing files. Of course, the generated script didn’t work correctly the first time and required modification. There were also issues with how it downloaded multiple assets to the exact same file and didn’t preserve any of the repository structure. But eventually, I was able to get it to generate a script that extracted all the current assets from my Nexus repository. I then proceeded to back up and clean out the upgraded Nexus volume before running Nexus 3.76.1, the very last Free and Open Source release. I did have to manually recreate all the repositories, users and roles. Once that was done, I once again utilized Claude Code to create the inverse of what it had just written. I then published all my old artifacts back to the newly running Nexus. At no time did I create or alter any of the code myself, just the configuration files. The code it generated isn’t terrible. There is a lot of it though. I’d be wary of non-programmers running generated code without understanding how to read it first, as badly generated code can wipe out a year or more of projects<sup 6 fn:6 </sup . I’ve published the generated code as nexus-repo-extract https://gitlab.com/djsumdog/nexus-repo-extract , so you can be the judge of the output. Final Thoughts on Sonatype What Sonatype did with their 3.77 release of Nexus is an absolutely garbage move. They implemented a dark pattern that made the shift from their free and open-source tool into a closed, expensive and proprietary tool in a minor point release update. It’s disgusting and shows the company does not care at all about open source. I’m glad I caught this upgrade when I did. Although Sonatype still has a public repository for the open-source version of Nexus published under the Eclipse Public License, they no longer provide releases leaving developers to compile it themselves<sup 7 fn:7 </sup . The confusion over what is open source and proprietary is leading me to seek migration options away from Nexus entirely. Thoughts on AI I will admit that code generation has come a considerable way in the past few years. Yet, I’m still wary of people who treat it with abundant confidence. It’s not the LLMs themselves that should be of concern, but the insane amount of trust people put in them. Outside the software engineering world, there has already been a case of a chatbot encouraging a 14 year-old’s suicide<sup 8 fn:8 </sup . Another lawsuit alleges a chatbot hinted at parenticide to a 9-year-old child<sup 9 fn:9 </sup . The White House recently released a health report with citations to studies that did not exist, suggesting it may have been made using generative AI<sup 10 fn:10 </sup . Many people don’t understand the foundations of LLMs. They’re basically just very large mappings of weights or parameters from a massive set of parts of words tokens to every other part of a word<sup 11 fn:11 </sup . Chatbots use a transformer that breaks apart a prompt into tokens and runs it through a series of blocks that generate results based on a pre-trained model<sup 12 fn:12 </sup . An LLM is basically a weighted random word generator, where the weights are derived by massive amounts of expensive human reinforced feedback training. When it gets something correct , it’s almost like an accident. When something that looks correct occurs often, the chatbot seems like an intelligent oracle. Yet, as observed above, initial prompts had to be rerun to truly get the correct results for code generation. LLMs should certainly not be used to replace high-value work in fields that require a high level of accuracy in facts<sup 13 fn:13 </sup . At the same time, people need to stop using words like “ hallucinating ” or “ lying ” when referring to LLMs, as these trained word generators lack the intent for such attributes. When it comes to software engineering, I’ll admit these tools are getting better and seem like they can be immensely valuable for quickly generating large feature sets. Rules can be added to newer editors and generators, which ensure certain standards and code styles are applied. Still, they generate a lot of code that I doubt people fully review. They do require oversight and shouldn’t be used to generate anything software engineers couldn’t write themselves. I do have concerns about how younger junior engineers can even enter a field that is pushing developers to utilize AI. The software industry could easily enter an era in a few years when massive engineering efforts will be needed to understand and fix the ever-increasing mountain of technical debt from the current era of LLM code generation. 1. Yum group checksum issues https://community.sonatype.com/t/yum-group-checksum-issues/4354 . 2020 June. Erasmus. Sonatype Community. ↩ fnref:1 2. Nexus Repository 2.11.2-03 Repository Checksum Bug https://support.sonatype.com/hc/en-us/articles/213465008-Nexus-Repository-2-11-2-03-Repository-Checksum-Bug . 29 January 2025. Sonatype Support. ↩ fnref:2 3. Changes to Nexus Repository Core codebase https://community.sonatype.com/t/changes-to-nexus-repository-core-codebase/14341 . 6 Febuary 2025. montag. Sonatype Community. ↩ fnref:3 4. Downgrading from Nexus Community Edition to OSS https://community.sonatype.com/t/downgrading-from-nexus-community-edition-to-oss/14439 . 20 Feburary 2025. Moore. Sonatype Community. ↩ fnref:4 5. RollBackup “Downgrade” Nexus Repository de 3.13 vers 3.8 https://community.sonatype.com/t/rollbackup-downgrade-nexus-repository-de-3-13-vers-3-8/399 . 2018 August. Azoumed. Sonatype Community. ↩ fnref:5 6. Lost a Year of Ableton Projects After Running a Terminal Script – Need Help Recovering Anything https://old.reddit.com/r/ableton/comments/1kmnhfu/lost a year of ableton projects after running a/ . 14 May 2025. u/Silent Moment 1852. r/ableton. Reddit. Archive https://archive.is/58qQj ↩ fnref:6 7. Zora’s Reply to Downgrading from Nexus Community Edition to OSS https://community.sonatype.com/t/downgrading-from-nexus-community-edition-to-oss/14439/4 . 21 Feburary 2025. jzora. Sonatype Community. ↩ fnref:7 8. Boy, 14, fell in love with ‘Game of Thrones’ chatbot — then killed himself after AI app told him to ‘come home’ to ‘her’: mom https://nypost.com/2024/10/23/us-news/florida-boy-14-killed-himself-after-falling-in-love-with-game-of-thrones-a-i-chatbot-lawsuit/ . 23 October 2024. Crane. New York Post. ↩ fnref:8 9. Lawsuit: A chatbot hinted a kid should kill his parents over screen time limits https://www.npr.org/2024/12/10/nx-s1-5222574/kids-character-ai-lawsuit . 10 December 2024. Allyn. NPR. ↩ fnref:9 10. White House Health Report Included Fake Citations https://www.nytimes.com/2025/05/29/well/maha-report-citations.html . 29 May 2025. Blum. Astor. The New York Times. ↩ fnref:10 11. Large Language Models explained briefly https://youtu.be/LPZh9BOjkQs . 20 November 2024. 3Blue1Brown. ↩ fnref:11 12. Attention in transformers, step-by-step - Deep Learning Chapter 6 https://youtu.be/eMlx5fFNoYc . 7 April 2024. 3Blue1Brown. ↩ fnref:12 13. Maybe AI Isn’t Going to Replace You at Work After All https://charleshughsmith.substack.com/p/maybe-ai-isnt-going-to-replace-you . 21 July 2025. Smith. Archive https://archive.is/Prz5z . ↩ fnref:13