From 39c0a1c9e42659caefce723d092e4e4d67d54783 Mon Sep 17 00:00:00 2001
From: wenytang-ms <wenyutang@microsoft.com>
Date: Tue, 28 Jul 2026 16:56:45 +0800
Subject: [PATCH] build: drop the unreachable snapshot repository and pin p2 to
 its origin

The oss.sonatype.org entry declares a snapshots repository, but every
artifact resolved against it carries a release version, so a request to
it can only ever 404. The last nightly build (31823304) issued 42 such
requests and completed none of them:

    Downloading from oss.sonatype.org:   42
    Downloaded from oss.sonatype.org:     0

Maven fell back to Central for all of them, so removing the entry does
not change which artifacts are resolved. It does remove an external host
from the build and saves 42 failed round trips.

download.eclipse.org answers p2 requests with a redirect to a mirror
chosen per request from a pool of third party hosts. Because the target
definition references /eclipse/updates/4.35/ and /releases/2024-12/,
which are mirrored, that same build read most of its bundles from five
hosts none of the repository declares:

    eclipse.mirror.rafal.ca, ca.mirrors.cicku.me, mirror.aarnet.edu.au,
    ftp2.osuosl.org, mirror.cs.odu.edu

The selection is made per request, so the host set differs between runs
and cannot be enumerated ahead of time. eclipse.p2.mirrors=false makes
p2 read from the URL in the target definition instead, so the set of
addresses the build contacts is the set it declares.

Both changes narrow the addresses the pipeline reaches without changing
the artifacts it produces. This is groundwork for routing the remaining
Maven Central traffic through the Central Feed Service: an allow list or
an exception request can only be written against a host set that is
known in advance.
---
 jdtls.ext/pom.xml        | 9 ---------
 scripts/buildJdtlsExt.js | 5 ++++-
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/jdtls.ext/pom.xml b/jdtls.ext/pom.xml
index d76a1b74..6c9688b6 100644
--- a/jdtls.ext/pom.xml
+++ b/jdtls.ext/pom.xml
@@ -131,13 +131,4 @@
             </properties>
         </profile>
     </profiles>
-    <repositories>
-        <repository>
-            <id>oss.sonatype.org</id>
-            <url>https://oss.sonatype.org/content/repositories/snapshots/</url>
-            <snapshots>
-                <enabled>true</enabled>
-            </snapshots>
-        </repository>
-    </repositories>
 </project>
diff --git a/scripts/buildJdtlsExt.js b/scripts/buildJdtlsExt.js
index 0785d8c4..f3356211 100644
--- a/scripts/buildJdtlsExt.js
+++ b/scripts/buildJdtlsExt.js
@@ -18,7 +18,10 @@ const jvmOptions = [
 const env = { ...process.env };
 env.MAVEN_OPTS = env.MAVEN_OPTS ? env.MAVEN_OPTS + ' ' + jvmOptions : jvmOptions;
 
-const mvnCommand = `${mvnw()} clean package`;
+// `eclipse.p2.mirrors=false` stops p2 from following download.eclipse.org's mirror
+// redirect, which hands out a different third party host per request and makes the
+// set of addresses the build contacts impossible to express as an allow list.
+const mvnCommand = `${mvnw()} clean package -Declipse.p2.mirrors=false`;
 cp.execSync(mvnCommand, {cwd:server_dir, stdio:[0,1,2], env: env} );
 copy(path.join(server_dir, 'com.microsoft.jdtls.ext.core/target'), path.resolve('server'), (file) => {
     return /^com.microsoft.jdtls.ext.core.*.jar$/.test(file);