Sonatype support ticket #128515 (no response yet, posting here too).
Namespace: io.github.ddsha441981
Project: GitHub - ddsha441981/wiredoctor: 🩺 Zero-intrusion runtime diagnostic and architectural analyzer for Spring Boot. Automatically detects cyclic dependencies, proxy overheads, and startup bottlenecks with an interactive physics-based HTML dashboard. · GitHub
Artifact: wiredoctor-parent 1.2.0 (multi-module: parent + wiredoctor-actuator + wiredoctor-autoconfigure)
The Central Portal keeps rejecting validation with:
Bundle has content that does NOT have a .pom file: wiredoctor-parent, -actuator, -autoconfigure
(category "common:")
This message is false for our bundle. We unzipped the exact uploaded bundle (target/central-publishing/central-bundle.zip, central-publishing-maven-plugin 0.11.0). All three .pom files are present in the correct Maven layout:
io/github/ddsha441981/wiredoctor-parent/1.2.0/wiredoctor-parent-1.2.0.pom
io/github/ddsha441981/wiredoctor-actuator/1.2.0/wiredoctor-actuator-1.2.0.pom
io/github/ddsha441981/wiredoctor-autoconfigure/1.2.0/wiredoctor-autoconfigure-1.2.0.pom
Each has a matching .asc signature plus md5/sha1/sha256/sha512 sidecars. No stray entries.
The previous release of the same project, wiredoctor-parent 1.1.4, is structurally identical and was accepted and published on 24 Aug 2026 (deployment run 32773186458).
Failing deployments (same error every time, nothing published):
- 135351d4 — 12 Oct 2026 (GitHub Actions run 38258076967)
- ae3eba88 — 11 Oct 2026 (run 38105086649)
- f129db4b, 2f0f6107 — 10 Oct 2026
Ruled out on our side: GPG plugin version (3.2.2 and 3.2.8 both fail), the organization element in the POM (no effect), plugin version (0.11.0 is latest), version consistency (all modules 1.2.0, no -SNAPSHOT). status.maven.com shows no incident. This started failing on 10 Oct 2026; the same build passed in August.
Has anyone seen this validation false-positive? Could Sonatype staff check the server-side validation logs for deployment 135351d4 and tell us the real reason?