Make sbt Docker e2e jar fetch survive Central 403/404s

[Mikola Lysenko (mikolalysenko)]

Problem

sbt / Mill / scala-cli compatibility failed on an unrelated PR (refactor/crate-bloat-cleanup, run 37948228245, job sbt 2.0.9 / jdk 17 / agent):

---- agent_sbt_versions_patch_in_place stdout ----
panicked at crates/socket-patch-cli/tests/docker_e2e_sbt.rs:136:9:
https://repo1.maven.org/maven2/org/apache/commons/commons-text/1.9/commons-text-1.9.jar: 404 Not Found
test result: FAILED. 1 passed; 1 failed; ... finished in 0.05s

The cell died before docker run, on the test's own download of the pristine jar. That jar has been on Central since 2020. It was 1 of the 7 failed pull_request runs in the last 8h, and the only one with an infra cause that no open PR already covers. The Bun refusalCodesExact cell is the other candidate, but #1244 already changes scripts/backtest-bun.py.

Update: 403 seen too

This PR's own run 37954180751 failed sbt 1.9.9 / jdk 17 / agent: both tests failed in 0.07s with commons-text-1.9.jar: 403 Forbidden. The other 7 agent legs in the same run fetched the jar fine, so it is the same per-runner edge blip as the 404. The second commit also retries 403 and sets a User-Agent (reqwest sends none by default).

Update 2: a 403 that outlasted the retries, so add a mirror fallback

coverage-docker (sbt) (run 37957095405, required by ci-ok) got 403 Forbidden from repo1.maven.org on all 5 tries in both agent tests. Retrying the same edge can't ride that out. The third commit:

• alternates attempts between repo1.maven.org and Google's official Central mirror (maven-central.storage-download.googleapis.com/maven2);
• pins Central's published sha1 (ba6ac8c2…e2, identical from all three hosts) and checks the jar against it, so whichever mirror answers, the test patches the exact released bytes. It also drops the separate .sha1 request.

Local proof: a scratch test calling jars() passes. With the Central base URL deliberately broken (Central answers 403), attempt 2 gets the jar from the mirror and the sha1 matches. I removed the scratch test afterwards.

Update 3: User-Agent removed

On d63015a, every Linux agent, mill and scala-cli leg of run 37957095379, plus coverage-docker (sbt), got 403 from repo1.maven.org on all 5 tries. On the commit before it, 7 of 8 legs fetched the jar fine. The custom User-Agent is the likeliest trigger, so 2f52f2f drops it and goes back to reqwest's default request. The pinned-sha1 Google-mirror fallback stays.

Root cause

fetch_from_central retries only transport errors, 429 and 5xx. A 404 failed on the first attempt. Central's CDN sometimes serves a stale negative entry for an artifact that exists. scripts/sbt-warm-seed.sh already lists "a CDN 429, 404 or reset" as a blip it retries.

Fix

Also retry 404 Not Found in fetch_from_central, with the same 5 attempts and backoff. Every URL the helper fetches is a pinned, released artifact (CENTRAL_JAR and its .sha1), so a 404 can't be a real "artifact gone" signal that a retry would hide. If one ever were, the final panic! still fails the test, now with the attempt history. This doesn't change test coverage, and there are no workflow changes.

Proof

• cargo clippy -p socket-patch-cli --features docker-e2e --test docker_e2e_sbt -- -D warnings: clean.
• rustfmt --check on the touched file: clean.
• I didn't run the Docker test locally because there is no Docker daemon in the sandbox. The sbt compatibility workflow on this PR exercises it.

Where tests run

Unchanged. No tests were removed or moved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CfAQ1cTuWfH3kKiCi6pPR4

---

Generated by Claude Code

---

Note

Low Risk
Test-only changes to HTTP retry and mirror selection for a fixed fixture jar; no production or workflow behavior.

Overview
Hardens the sbt Docker e2e fixture so CI no longer flakes when repo1.maven.org returns 403/404 for the pinned commons-text-1.9.jar before containers even start.

fetch_from_central now takes a Maven path (not a full URL), alternates between Maven Central and Google’s official Central mirror across up to six retries, and treats 403, 404, 429, and 5xx (plus transport errors) as transient. Backoff is capped; failure logs include the mirror URL.

jars() drops the live .sha1 fetch and asserts the downloaded bytes against a pinned Central SHA1, so either mirror can serve the artifact without changing test semantics.

^{Reviewed by Cursor Bugbot for commit 2f52f2f. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

hosted-e2e and e2e (ubuntu-latest, e2e_safety_pnpm) are red on this PR, but the cause is not this PR. Production stopped publishing the free pkg:npm/minimist@1.2.2 patch at about 15:30Z, and both suites are pinned to it. The same two jobs fail in merge_group run 37954543526 (#1284). This diff only touches a docker-e2e-gated sbt test. No fix exists to port yet; I tracked it in #1293. A re-run will not help until production or the pins change.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2f52f2f. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 2f52f2fb
• CI: every check green except main-wide failures that also fail on main at a8e9397: e2e (ubuntu-latest, e2e_safety_pnpm), hosted-e2e (withdrawn free minimist@1.2.2 patch, Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293; fixes in Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) #1301/Follow the republished minimist canary patch #1302), and the ci-ok roll-up.
• Bugbot: reviewed this head, no findings; no open review threads.
• No CHANGELOG.md changes.
• CI-only change (sbt Docker e2e jar fetch retry).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

[final reviewer] I disarmed auto-merge. Tanmay Singla (@Tanmay182003), three commits that aren't merges from main landed after your approval at 68f2313f. Please take another look at head 3bff1315:

• d63015a retries the sbt e2e Central jar fetch on 403 as well as 404, and sends a User-Agent.
• f04ae77 falls back to Google's Maven Central mirror when Central keeps refusing.
• 2f52f2f drops the custom User-Agent again.

All three are confined to the sbt Docker e2e fetch (test infra, no product code). Once you re-approve, auto-merge can be re-armed.

---

Generated by Claude Code