WARNING: CI disabled because of Sonatype rejects all incoming calls with an HTTP status 429

[Luca Milanesio]

Hi all,

I had to disable the incoming validations on the Gerrit-CI because all of them are failing since today 5 PM PDT (1 AM BST / 2 AM CEST).
The root cause of the failures is in Sonatype’s infrastructure returning an HTTP status 429, see the full story at [1].

We need to find another solution as downloading the artifacts form Maven Central isn’t a suitable option anymore.
What we should aim is to have all the artifacts we need to produce a Gerrit release inside our infrastructure, without having to rely on Sonatype’s servers anymore.

The last successful validation was [2] and, after that, all of them failed.

Luca.

[1] https://central.sonatype.org/faq/429-error/
[2] https://gerrit-ci.gerritforge.com/view/Gerrit/job/Gerrit-verifier-chrome-latest/44693/

[Luca Milanesio]

> On 16 Aug 2026, at 22:05, Luca Milanesio <luca.mi...@gmail.com> wrote:
>
> Hi all,
>
> I had to disable the incoming validations on the Gerrit-CI because all of them are failing since today 5 PM PDT (1 AM BST / 2 AM CEST).
> The root cause of the failures is in Sonatype’s infrastructure returning an HTTP status 429, see the full story at [1].

Sonatype’s Maven is now responding again: I’ve enabled the change validation back on Gerrit-CI.

> We need to find another solution as downloading the artifacts form Maven Central isn’t a suitable option anymore.
> What we should aim is to have all the artifacts we need to produce a Gerrit release inside our infrastructure, without having to rely on Sonatype’s servers anymore.

I’ve uploaded hundreds of Maven packages we use to https://gerrit-maven.storage.googleapis.com infrastructure, hopefully that helps.
We need to find a way to automate the upload and fail if we fetch a Maven artifact which isn’t present in our infrastructure.

Luca.

[Saša Živkov]

On Mon, Aug 17, 2026 at 10:53 AM Luca Milanesio <luca.mi...@gmail.com> wrote:

> On 16 Aug 2026, at 22:05, Luca Milanesio <luca.mi...@gmail.com> wrote:
>
> Hi all,
>
> I had to disable the incoming validations on the Gerrit-CI because all of them are failing since today 5 PM PDT (1 AM BST / 2 AM CEST).
> The root cause of the failures is in Sonatype’s infrastructure returning an HTTP status 429, see the full story at [1].

Sonatype’s Maven is now responding again: I’ve enabled the change validation back on Gerrit-CI.

OK, but from [1] I understand that this is a kind of rate-limit and that we need to address this issue soon.

 

> We need to find another solution as downloading the artifacts form Maven Central isn’t a suitable option anymore.
> What we should aim is to have all the artifacts we need to produce a Gerrit release inside our infrastructure, without having to rely on Sonatype’s servers anymore.

I’ve uploaded hundreds of Maven packages we use to https://gerrit-maven.storage.googleapis.com infrastructure, hopefully that helps.
We need to find a way to automate the upload and fail if we fetch a Maven artifact which isn’t present in our infrastructure.

Luca.

>
> The last successful validation was [2] and, after that, all of them failed.
>
> Luca.
>
> [1] https://central.sonatype.org/faq/429-error/
> [2] https://gerrit-ci.gerritforge.com/view/Gerrit/job/Gerrit-verifier-chrome-latest/44693/
>

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/repo-discuss/231AADEA-0D8F-4DB7-950A-0D7CCE4973B3%40gmail.com.

[Matthias Sohn]

On Mon, Aug 17, 2026 at 10:53 AM Luca Milanesio <luca.mi...@gmail.com> wrote:

> On 16 Aug 2026, at 22:05, Luca Milanesio <luca.mi...@gmail.com> wrote:
>
> Hi all,
>
> I had to disable the incoming validations on the Gerrit-CI because all of them are failing since today 5 PM PDT (1 AM BST / 2 AM CEST).
> The root cause of the failures is in Sonatype’s infrastructure returning an HTTP status 429, see the full story at [1].

Sonatype’s Maven is now responding again: I’ve enabled the change validation back on Gerrit-CI.

> We need to find another solution as downloading the artifacts form Maven Central isn’t a suitable option anymore.
> What we should aim is to have all the artifacts we need to produce a Gerrit release inside our infrastructure, without having to rely on Sonatype’s servers anymore.

I’ve uploaded hundreds of Maven packages we use to https://gerrit-maven.storage.googleapis.com infrastructure, hopefully that helps.
We need to find a way to automate the upload and fail if we fetch a Maven artifact which isn’t present in our infrastructure.

Looks like we could use a GCP artifact registry as a transparent mirror of Maven central
https://docs.cloud.google.com/artifact-registry/docs/repositories/remote-repo

https://maven.apache.org/guides/mini/guide-mirror-settings.html

Luca.

>
> The last successful validation was [2] and, after that, all of them failed.
>
> Luca.
>
> [1] https://central.sonatype.org/faq/429-error/
> [2] https://gerrit-ci.gerritforge.com/view/Gerrit/job/Gerrit-verifier-chrome-latest/44693/
>