From b84d68e2f397b8f2e1a848f1597c464bb632d610 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 8 Oct 2026 14:45:25 +0000
Subject: [PATCH] Fetch Maven from Central, not the Apache archive

archive.apache.org throttles bulk downloads: the "Install Maven" step
takes 67-333s per leg (65-75 runner-minutes per CI run across the
Maven/Gradle e2e legs, every PR push and merge_group run). Maven
Central's CDN serves the same apache-maven-<v>-bin.tar.gz in well under
a second.

Keep fetching the .sha512 from the Apache archive: it is a tiny file,
Central has none for 3.6.3 and 3.8.9, and checking the Central bytes
against a digest from a second origin keeps the integrity check
meaningful. Verified locally that Central's tarballs for 3.6.3, 3.8.9,
3.9.2 and 3.9.16 match the archive's sha512 (and 3.9.3, 3.9.4 and
4.0.0-rc-6 match Central's own).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ivTAqBDyJHVt8PEUaDYW3
---
 .github/workflows/ci.yml                   | 16 +++++++++++-----
 .github/workflows/gradle-compatibility.yml |  8 ++++++--
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cce660612..c78a8ab36 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1470,17 +1470,23 @@ jobs:
 
       - name: Install Maven ${{ matrix.maven || '3.9.16' }}
         if: steps.jvm.outputs.maven == 'true'
-        # Straight from the Apache archive (sha512-verified), so a leg gets
-        # exactly the release it names rather than the runner's Maven.
-        # --ssl-revoke-best-effort: see the `test` job's vexctl step.
+        # The exact release a leg names rather than the runner's Maven. The
+        # tarball comes from Maven Central's CDN (well under a second);
+        # archive.apache.org throttles bulk downloads to 1.5-5.5 minutes per
+        # leg. Its sha512 still comes from the Apache archive (Central has
+        # none for 3.6.3/3.8.9), so the bytes are checked against a digest
+        # from a second origin. --ssl-revoke-best-effort: see the `test`
+        # job's vexctl step.
         shell: bash
         env:
           MAVEN_VERSION: ${{ matrix.maven || '3.9.16' }}
         run: |
           major="${MAVEN_VERSION%%.*}"
-          url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          file="apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          url="https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/${file}"
+          sha_url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/${file}.sha512"
           curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$sha_url" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           # Python accepts native Windows paths for both archive and destination.
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
diff --git a/.github/workflows/gradle-compatibility.yml b/.github/workflows/gradle-compatibility.yml
index 8ebf4842b..70081afb1 100644
--- a/.github/workflows/gradle-compatibility.yml
+++ b/.github/workflows/gradle-compatibility.yml
@@ -256,9 +256,13 @@ jobs:
           # TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the CA's
           # revocation server is unreachable. A revoked certificate still fails;
           # the body is checked against a digest right after. A no-op elsewhere.
-          url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          # Tarball from Maven Central's CDN, digest from the Apache archive,
+          # which throttles the tarball itself to minutes (ci.yml's copy).
+          file="apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          url="https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/${file}"
+          sha_url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/${file}.sha512"
           curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$sha_url" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn"