Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9

[woznik]

Describe the bug

I found an issue with ORT Analyzer.
I use ORT in corporate network. No connection to Internet.
The project is simple maven project with just one dependency:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>Maven</artifactId>
    <version>1.0-SNAPSHOT</version>

    <dependencies>

        <!-- https://mvnrepository.com/artifact/guru.springframework/chuck-norris-for-actuator -->
        <dependency>
            <groupId>guru.springframework</groupId>
            <artifactId>chuck-norris-for-actuator</artifactId>
            <version>3.0.0-M4</version>
        </dependency>



    </dependencies>
    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

</project>

In order to point the maven repository I created ~/.m2/settings.xml file.

I tried both ways:
Setting mirror as mirrorOf central and setting mirror as active profile
Both are pointing in the end to the same issue

Could not get package information for dependency 'guru.springframework:chuck-norris-for-actuator:3.0.0-M4': ArtifactDescriptorException: Failed to read artifact descriptor for guru.springframework:chuck-norris-for-actuator:jar:3.0.0-M4
Caused by: UnresolvableModelException: The following artifacts could not be resolved: io.zipkin.brave:brave-bom:pom:5.13.9 (absent): Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
    Caused by: ArtifactResolutionException: The following artifacts could not be resolved: io.zipkin.brave:brave-bom:pom:5.13.9 (absent): Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
        Caused by: ArtifactTransferException: Could not transfer artifact io.zipkin.brave:brave-bom:pom:5.13.9 from/to central (https://repo.maven.apache.org/maven2): Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
            Caused by: ConnectTimeoutException: Connect to repo.maven.apache.org:443 [repo.maven.apache.org/199.232.16.215] failed: Connect timed out
                Caused by: SocketTimeoutException: Connect timed out

Despite the fact that I overwritten central repository by the corporate mirror ORT has hardcoded address to the mavenCentral repo

What is interesting is the fact that the package io.zipkin.brave:brave-bom:pom:5.13.9 exists in my mirror so there is no reason to go to mvnCentral

So there are to cases:

ORT cannot find the artifact while it exists in the mirror. (maybe to short time out to get the pom)

How to overide mavenCentral repository so in case there is no Internet connection the process will not waste time for timeouts

• ORT version: (ort-minimal:28.0.0-079.sha.ce116dd)
• Java version: 17
• OS: Ubuntu 22.04

ORT works ok when the access to Internet is granted.
PS: I cannot use slack for communication