2.42 plugin marker artifact not available at Google maven

Hi,

in the past we only used google() and gradlePluginPortal() as maven repositories for our plugin configuration in Gradle. With 2.41 we switched to the new com.google.dagger.hilt.android plugin ID (which worked fine). Now after updating to 2.42 we were forced to add mavenCentral() as a plugin repository.

So I guess the plugin marker artifact is missing in Google Maven?

Current behaviour: Using the com.google.dagger.hilt.android plugin ID requires to add/use mavenCentral() as repository.

Expected behaviour: Using the com.google.dagger.hilt.android plugin ID should work with only google() as repository (same as 2.41)

[danysantiago]

Thanks for the detailed explanation and investigation @tbroyer! I’ll close this now since there is no action item for us.

[tbroyer]

Fwiw, I confirm that this is a problem with JCenter. Currently, partly because of JCenter’s unreliability, Gradle, Inc. has setup a cache on their side; so when you try to resolve some artifact from plugins.gradle.org/m2, here’s what happens:

1. if the gradlePluginPortal hosts the artifact, it returns it (that’s the case for plugins that are directly deployed to the plugin portal)
2. otherwise, it redirects to resolve from Gradle’s jcenter-cache; if it has the artifact in its cache, it returns it
3. otherwise, it proxies to JCenter; if JCenter has the artifact (deployed there directly before it became readonly, or cached), it returns it
4. otherwise, it proxies to Central

The problem here is that JCenter currently seems to answer with a 403.

Try for yourself:

1. https://plugins.gradle.org/m2/com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom
2. https://repo.gradle.org/artifactory/jcenter/com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom
3. https://jcenter.bintray.com/com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom
4. https://repo1.maven.org/maven2/com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom

And currently, at step 2:

$ http https://repo.gradle.org/artifactory/jcenter/com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom
HTTP/1.1 404 Not Found
CF-Cache-Status: DYNAMIC
CF-RAY: 709b8b05ce2d99cc-CDG
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/json;charset=ISO-8859-1
Date: Wed, 11 May 2022 14:18:17 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
X-Artifactory-Id: e83ceb0f7a2c70b23b1e2c017efd4f33dd0719f2
X-Artifactory-Node-Id: gradle-artifactory-primary-2
X-JFrog-Version: Artifactory/7.34.4 73404900

{
    "errors": [
        {
            "message": "jcenter: is assumed offline, 'jcenter:com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom' is not found at 'com/google/dagger/hilt/android/com.google.dagger.hilt.android.gradle.plugin/2.42/com.google.dagger.hilt.android.gradle.plugin-2.42.pom'.",
            "status": 404
        }
    ]
}

Now try it out with 2.41, you get the POM, because it was cached already.

My rule of thumb, because of the unreliability of JCenter (not only in terms of availability, I caught them rewriting the POMs from time to time, breaking checksum verifications), is to always gradlePluginPortal() last, and add mavenCentral(): if it’s not in gradlePluginPortal, it has good chances to be in mavenCentral, unless you rely on an old artifact that was only available in JCenter before it became readonly, and then you’re dependent on JCenter’s availability. Presence of artifacts in JCenter only is probably the only reason Gradle cannot break that dependency, which is why they setup an additional cache for when JCenter is unavailable.

TL;DR:

pluginManagement {
    repositories {
        // gradlePluginPortal redirects to JCenter which is unreliable,
        // prefer Central to JCenter (for the same dependencies)
        // cf. https://github.com/gradle/gradle/issues/15406
        mavenCentral()
        gradlePluginPortal()
    }
}