Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9

[woznik]

Describe the bug

I found an issue with ORT Analyzer.
I use ORT in corporate network. No connection to Internet.
The project is simple maven project with just one dependency:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>Maven</artifactId>
    <version>1.0-SNAPSHOT</version>

    <dependencies>

        <!-- https://mvnrepository.com/artifact/guru.springframework/chuck-norris-for-actuator -->
        <dependency>
            <groupId>guru.springframework</groupId>
            <artifactId>chuck-norris-for-actuator</artifactId>
            <version>3.0.0-M4</version>
        </dependency>



    </dependencies>
    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

</project>

In order to point the maven repository I created ~/.m2/settings.xml file.

I tried both ways:
Setting mirror as mirrorOf central and setting mirror as active profile
Both are pointing in the end to the same issue

Could not get package information for dependency 'guru.springframework:chuck-norris-for-actuator:3.0.0-M4': ArtifactDescriptorException: Failed to read artifact descriptor for guru.springframework:chuck-norris-for-actuator:jar:3.0.0-M4
Caused by: UnresolvableModelException: The following artifacts could not be resolved: io.zipkin.brave:brave-bom:pom:5.13.9 (absent): Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
    Caused by: ArtifactResolutionException: The following artifacts could not be resolved: io.zipkin.brave:brave-bom:pom:5.13.9 (absent): Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
        Caused by: ArtifactTransferException: Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
            Caused by: ConnectTimeoutException: Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
                Caused by: SocketTimeoutException: Connect timed out

Despite the fact that I overwritten central repository by the corporate mirror ORT has hardcoded address to the mavenCentral repo

What is interesting is the fact that the package io.zipkin.brave:brave-bom:pom:5.13.9 exists in my mirror so there is no reason to go to mvnCentral

So there are to cases:

ORT cannot find the artifact while it exists in the mirror. (maybe to short time out to get the pom)

How to overide mavenCentral repository so in case there is no Internet connection the process will not waste time for timeouts

• ORT version: (ort-minimal:28.0.0-079.sha.ce116dd)
• Java version: 17
• OS: Ubuntu 22.04

ORT works ok when the access to Internet is granted.
PS: I cannot use slack for communication

[sschuberth]

@woznik could you give #9263 a try to see if it makes a difference?

[woznik]

@sschuberth
I just used the image ort from today

/        \_______   \__    ___/  The OSS Review Toolkit, version 35.0.0-040.sha.118fab7,
|    |   | |       _/ |    |     built with JDK 21.0.4+7-LTS, running under Java 21.0.4.
|    |   | |    |   \ |    |     Executing 'analyze' as 'ort' on Linux
\________/ |____|___/ |____|     with 2 CPUs and a maximum of 1988 MiB of memory.

but still the same behavior

20:53:37.322 [DefaultDispatcher-worker-1] DEBUG org.ossreviewtoolkit.plugins.packagemanagers.maven.utils.MavenSupport$requestRemoteArtifact$4$2 - Transfer failed for repository with ID 'central': GET_EXISTENCE FAILED https://repo-xxxxx.xxxxx.xxx/repository/maven-public/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar <> /home/ort/.m2/repository/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar
20:53:37.323 [DefaultDispatcher-worker-1] DEBUG org.ossreviewtoolkit.plugins.packagemanagers.maven.utils.MavenSupport - ArtifactNotFoundException: Could not find artifact com.google.cloud:spring-cloud-gcp-starter-pubsub:jar:sources:3.5.5 in central (https://repo-xxxxx.xxxxx.xxx/repository/maven-public/)
20:53:37.323 [DefaultDispatcher-worker-1] DEBUG org.ossreviewtoolkit.plugins.packagemanagers.maven.utils.MavenSupport - Trying to download artifact 'com.google.cloud:spring-cloud-gcp-starter-pubsub:jar:sources:3.5.5' from https://repo.maven.apache.org/maven2/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar.
20:53:37.323 [DefaultDispatcher-worker-1] DEBUG org.eclipse.aether.internal.impl.DefaultTransporterProvider - Using transporter HttpTransporter with priority 5.0 for https://repo.maven.apache.org/maven2
20:53:37.323 [DefaultDispatcher-worker-1] DEBUG org.eclipse.aether.internal.impl.DefaultRepositoryConnectorProvider - Using connector BasicRepositoryConnector with priority 0.0 for https://repo.maven.apache.org/maven2
20:53:37.324 [DefaultDispatcher-worker-1] DEBUG org.apache.http.client.protocol.RequestAddCookies - CookieSpec selected: standard
20:53:37.324 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.conn.PoolingHttpClientConnectionManager - Connection request: [route: {s}->https://repo.maven.apache.org:443][total available: 1; route allocated: 0 of 50; total allocated: 1 of 100]
20:53:37.324 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.conn.PoolingHttpClientConnectionManager - Connection leased: [id: 15][route: {s}->https://repo.maven.apache.org:443][total available: 1; route allocated: 1 of 50; total allocated: 2 of 100]
20:53:37.324 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.execchain.MainClientExec - Opening connection {s}->https://repo.maven.apache.org:443
20:53:37.349 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.conn.DefaultHttpClientConnectionOperator - Connecting to repo.maven.apache.org/199.232.16.215:443
20:53:37.349 [DefaultDispatcher-worker-1] DEBUG org.apache.http.conn.ssl.SSLConnectionSocketFactory - Connecting socket to repo.maven.apache.org/199.232.16.215:443 with timeout 10000
20:53:47.360 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.conn.DefaultManagedHttpClientConnection - http-outgoing-15: Shutdown connection
20:53:47.360 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.execchain.MainClientExec - Connection discarded
20:53:47.360 [DefaultDispatcher-worker-1] DEBUG org.apache.http.impl.conn.PoolingHttpClientConnectionManager - Connection released: [id: 15][route: {s}->https://repo.maven.apache.org:443][total available: 1; route allocated: 0 of 50; total allocated: 1 of 100]
20:53:47.361 [DefaultDispatcher-worker-1] DEBUG org.ossreviewtoolkit.plugins.packagemanagers.maven.utils.MavenSupport$requestRemoteArtifact$4$2 - Transfer failed for repository with ID 'central': GET_EXISTENCE FAILED https://repo.maven.apache.org/maven2/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar <> /home/ort/.m2/repository/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar
20:53:47.363 [DefaultDispatcher-worker-1] DEBUG org.ossreviewtoolkit.plugins.packagemanagers.maven.utils.MavenSupport - ArtifactTransferException: Could not transfer artifact com.google.cloud:spring-cloud-gcp-starter-pubsub:jar:sources:3.5.5 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
Caused by: ConnectTimeoutException: Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
    Caused by: SocketTimeoutException: Connect timed out

In the code in file:

plugins/package-managers/maven/src/main/kotlin/utils/MavenSupport.kt

there is public maven Central repository hardcoded.

The settings.xml file that I use points to use only corporate internal repo and still ORT reaches for external repository.

*Beside the artifact https://repo.maven.apache.org/maven2/com/google/cloud/spring-cloud-gcp-starter-pubsub/3.5.5/spring-cloud-gcp-starter-pubsub-3.5.5-sources.jar truely does not exists even in mvnCentral

[sschuberth]

I just used the image ort from today

As you can see from its green (instead of purple) state, the PR is not merged yet, so it's not included in any image. You would need to build the PR from source to test it currently.

[oheger-bosch]

Not sure whether #9263 will have an impact here, since it addresses a very specific situation. The problems described here seem to be rather general when using ORT behind a proxy.

We have a proxy in our setup as well. To make it work, we pass the proxy-related system properties to the Java VM running ORT as described here. Especially the nonProxyHosts property seems to be quite important.
HTH