Rebuild Metadata creates incorrect md5 and sha1 for maven-metadata.xml

Customers have been raising issues with invalid checksums of maven-metadata.xml after Rebuild of Metadata.

I have reproduced this issue on nexus-professional-2.11.2-03 with the following steps.
1. Deploy new artifact to a maven repository.
2. Manually check under storage, that maven-metadata.xml, md5 and sha1 all match correctly (for that artifact).
3. Remove the file maven-metadata.xml, maven-metadata.xml.md5, maven-metadata.xml.sha1
4. From the UI, run "Rebuild Metadata" for that repository.
5. Manually check under storage, that newly created maven-metadata.xml, md5 and sha1 - this time they will not match.

We also noticed that the maven-metadata.xml lastUpdated was updated.

Following the same steps, I was unable to reproduce issue 2.11.1-01.

The symptoms of incorrect maven-metadata.xml occur for any hosted Maven 2 repository when Nexus needs to rewrite maven-metadata.xml files, which includes:

• when snapshots of the same GAV are removed by a Nexus scheduled task
• when a subset of release artifacts of the same GA are purged by a Nexus scheduled task
• when a subset of artifacts in the same GA are deleted from storage using the UI or API call
• when artifacts are deleted from proxy storage when smart proxy subscriptions are listening for delete events
• when release artifacts are uploaded using hosted repository UI upload, and the GA level maven-metadata.xml already exists
• when an explicit "Rebuild Maven Metadata" scheduled task is run and the task detects changes which require the maven-metadata.xml files to be rewritten
• when requests through group repositories calculate the merged metadata of specific components