1.63.0 artifacts are not available in GCS Maven Central mirror

[hisener]

This is not a gRPC Java issue, but I suspect other people are having the same issue.

When GCS Maven Central mirror is used, we get the following error in our Maven build.

Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Could not find artifact io.grpc:grpc-protobuf:jar:1.63.0 in google-maven-central (https://maven-central.storage-download.googleapis.com/maven2/)

It's because artifacts for v1.63.0 are not available in the GCS mirror. It can be checked using curl:

$ curl -LO https://maven-central.storage-download.googleapis.com/maven2/io/grpc/grpc-api/1.63.0/grpc-api-1.63.0.jar
$ cat grpc-api-1.63.0.jar
<?xml version='1.0' encoding='UTF-8'?><Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Details>No such object: maven-central/maven2/io/grpc/grpc-api/1.63.0/grpc-api-1.63.0.jar</Details></Error>

The same command works for v1.62.2:

$ curl -LO https://maven-central.storage-download.googleapis.com/maven2/io/grpc/grpc-api/1.62.2/grpc-api-1.62.2.jar
$ ls -al grpc-api-1.62.2.jar 
-rw-r--r-- 1 halil.sener 297099 Apr 17 11:47 grpc-api-1.62.2.jar

Do you have contact with GCS mirror maintainers, and is there a way to retrigger the mirroring process for the io.grpc group ID? Or, are you aware of a workaround for this issue?

[ejona86]

That's... weird. I can try and ask around, but I don't have any contact offhand. I checked, and it is returning 404, so a workaround would be to use regular Maven Central as a second repository (as long as you are specifying versions precisely, such that maven-metadata.xml wouldn't be used).

FWIW, https://maven-central.storage-download.googleapis.com/maven2/io/grpc/grpc-api/maven-metadata.xml also doesn't have the version.

[hisener]

Do you mean using it as a regular repository instead of a mirror? 🤔 I can give it a try. I guess it will increase the number of lookups we do, though.

[ejona86]

I found b/31927595 internally, and it does look like someone updated the mirror with the text "This is not an officially supported Google product." Unclear when that change was made; Wayback Machine didn't see it on its last crawl in Sept 2023. The recommendation at the moment seems to be stop using maven-central.storage-download.googleapis.com and use Maven Central directly.

I was speaking from the Gradle perspective. I'm not all that familiar with Maven's behavior here (although I think I fought something here once when Travis-CI used an unstable apache mirror).