Invalid LOC Header (Bad Signature) Error in Java

1. Invalid LOC Header (Bad Signature) in Java
2. Delete the Local Repository
3. Delete the Corrupted jar File
4. Validate the MD5 and SHA1 Checksums

This tutorial demonstrates Java’s invalid LOC header (bad signature) error.

Invalid LOC Header (Bad Signature) in Java

The invalid LOC header (bad signature) error occurs whenever a jar file in our local Maven repository is corrupt. The local repository is the downloaded file from a Maven project in our file system.

Every item that Maven downloaded comes with its MD5 and SHA1 files.

The purpose of these MD5 and SHA1 files is to ensure the originality and integrity of the original files. Since the error can occur in networks and file systems, these checksum files can also corrupt, making them not match the original.

Usually, the invalid LOC header (bad signature) error occurs in this situation. There are scenarios and solutions for this error given below.

Delete the Local Repository

As it’s clear from the name, we need to delete the whole local repository and create a new Maven project. This will remove all the Maven repository files, download the project files again, and delete the cache.

The following command can delete the repository.

rm -rf ${LOCAL_REPOSITORY}

We can specify the local repository in the settings.xml file. The default path for the local repository is ${user.home}/.m2/repository.

Delete the Corrupted jar File

If we find the corrupted jar file, we can delete it, and the problem will be solved. The Maven output stack command can show us the corrupted jar when it fails to process.

We can enable logging by putting a -X in the build command.

mvn -X package

The above command will indicate the corrupted jar file in a log file. We can find that jar file in the Maven repository and delete it.

The Maven will redownload the file upon build. The archive’s integrity can be tested using the zip -T command.

find ${LOCAL_REPOSITORY} -name "*.jar" | xargs -L 1 zip -T | grep error

Validate the MD5 and SHA1 Checksums

The above two solutions can make the Maven redownload the jar files. In these cases, the same invalid LOC header can occur in the future download.

Configuring the Maven to validate the MD5 and SHA1 checksums while downloading the item from the remote repository will prevent the invalid LOC header error.

The –strict-checksums or -C options are added to the Maven command, which will cause the Maven to fail the build when the checksums don’t match the value of the checksum files.

This can be done two ways, to fail the build or to warn it; the warn option is the default. Use the command below to fail or warn.

-C,--strict-checksums

-c,--lax-checksums

Because the Maven requires the signature files while uploading the artifacts to the repository, there might be artifacts in the repository which doesn’t have the signature files; that is why the warning option is the default.