From 5f7357176762d9249da0ef8c1cb31e88bd60dd64 Mon Sep 17 00:00:00 2001
From: wenytang-ms <wenyutang@microsoft.com>
Date: Tue, 28 Jul 2026 16:56:45 +0800
Subject: [PATCH] build: drop the unreachable snapshot repository and pin p2 to
 its origin

The oss.sonatype.org entry declares a snapshots repository, but every
artifact resolved against it carries a release version, so a request to
it can only ever 404. The last nightly build (31824861) issued 196 such
requests and completed none of them:

    Downloading from oss.sonatype.org:  196
    Downloaded from oss.sonatype.org:     0

Maven fell back to Central for all of them, so removing the entry does
not change which artifacts are resolved. It does remove an external host
from the build and saves 196 failed round trips.

download.eclipse.org answers p2 requests with a redirect to a mirror
chosen per request from a pool of third party hosts. Because the target
definition references /eclipse/updates/4.38/ and /releases/2025-12/,
which are mirrored, that same build read most of its bundles from eight
hosts none of the repository declares:

    mirror.cs.odu.edu, ftp2.osuosl.org, mirror.umd.edu,
    eclipse.mirror.rafal.ca, mirrors.xmission.com, mirrors.dotsrc.org,
    ca.mirrors.cicku.me, eclipse.c3sl.ufpr.br

The selection is made per request, so the host set differs between runs
and cannot be enumerated ahead of time. eclipse.p2.mirrors=false makes
p2 read from the URL in the target definition instead, so the set of
addresses the build contacts is the set it declares.

Both changes narrow the addresses the pipeline reaches without changing
the artifacts it produces. This is groundwork for routing the remaining
Maven Central traffic through the Central Feed Service: an allow list or
an exception request can only be written against a host set that is
known in advance.
---
 java-extension/pom.xml   | 9 ---------
 scripts/buildJdtlsExt.js | 5 ++++-
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/java-extension/pom.xml b/java-extension/pom.xml
index 6ca784e4..f65820f6 100644
--- a/java-extension/pom.xml
+++ b/java-extension/pom.xml
@@ -95,13 +95,4 @@
             </plugin>
         </plugins>
     </build>
-    <repositories>
-        <repository>
-            <id>oss.sonatype.org</id>
-            <url>https://oss.sonatype.org/content/repositories/snapshots/</url>
-            <snapshots>
-                <enabled>true</enabled>
-            </snapshots>
-        </repository>
-    </repositories>
 </project>
diff --git a/scripts/buildJdtlsExt.js b/scripts/buildJdtlsExt.js
index 8bcce4c2..2f36c1c1 100644
--- a/scripts/buildJdtlsExt.js
+++ b/scripts/buildJdtlsExt.js
@@ -38,7 +38,10 @@ const bundleList = [
 // Set MAVEN_OPTS to disable XML entity size limits for JDK XML parser
 const env = { ...process.env };
 env.MAVEN_OPTS = (env.MAVEN_OPTS || '') + ' -Djdk.xml.maxGeneralEntitySizeLimit=0 -Djdk.xml.totalEntitySizeLimit=0 -DentityExpansionLimit=0';
-cp.execSync(`${mvnw()} clean verify`, { cwd: serverDir, stdio: [0, 1, 2], env });
+// `eclipse.p2.mirrors=false` stops p2 from following download.eclipse.org's mirror
+// redirect, which hands out a different third party host per request and makes the
+// set of addresses the build contacts impossible to express as an allow list.
+cp.execSync(`${mvnw()} clean verify -Declipse.p2.mirrors=false`, { cwd: serverDir, stdio: [0, 1, 2], env });
 copy(path.join(serverDir, 'com.microsoft.java.test.plugin/target'), path.resolve('server'), (file) => path.extname(file) === '.jar');
 copy(path.join(serverDir, 'com.microsoft.java.test.runner/target'), path.resolve('server'), (file) => file.endsWith('jar-with-dependencies.jar'));
 copy(path.join(serverDir, 'com.microsoft.java.test.plugin.site/target/repository/plugins'), path.resolve('server'), (file) => {