Odd issue with http 403 error code on specific artifacts and platforms with gradle

[james-d-brown]

Hi,

Looking for some feedback on an issue we're experiencing with these two netcdf java dependencies that we're managing with gradle: edu.ucar:cdm-core:5.7.0 and edu.ucar:cdm-s3:5.7.0.

We're following the guidance here:

https://docs.unidata.ucar.edu/netcdf-java/current/userguide/using_netcdf_java_artifacts.html

We've been using 5.4.2 until now, without problems, but would like to upgrade to 5.7.0 (or, really, any version later than 5.4.2 where the cdms3 capability is working properly, as it appears not to work in 5.4.2). When building locally, I have no issues with 5.7.0. The artifacts are acquired successfully and our build succeeds. However, on our build server (GitHub action), we get this:

> Could not resolve all files for configuration ':wres-reading:runtimeClasspath'.
   > Could not resolve edu.ucar:cdm-core:5.7.0.
     Required by:
         project :wres-reading
      > Could not resolve edu.ucar:cdm-core:5.7.0.
         > Could not get resource 'https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/edu/ucar/cdm-core/5.7.0/cdm-core-5.7.0.pom'.
            > Could not GET 'https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/edu/ucar/cdm-core/5.7.0/cdm-core-5.7.0.pom'. Received status code 403 from server: Forbidden
   > Could not resolve edu.ucar:cdm-s3:5.7.0.
     Required by:
         project :wres-reading
      > Could not resolve edu.ucar:cdm-s3:5.7.0.
         > Could not get resource 'https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/edu/ucar/cdm-s3/5.7.0/cdm-s3-5.7.0.pom'.
            > Could not GET 'https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/edu/ucar/cdm-s3/5.7.0/cdm-s3-5.7.0.pom'. Received status code 403 from server: Forbidden

You can see an example here:

https://github.com/NOAA-OWP/wres/actions/runs/14217350086/job/39837006584

The issue appears to be conditional upon artifact version and build platform and is presumably mediated by gradle in some way, because all of these artifacts are easily accessible through a browser or curl without an http 403 error. For example, I can reproduce the above error on my local platform with version 5.6.0, specifically, but no other version (and, again, 5.7.0 works fine locally, but not on our build server).

It's unclear to me whether this is a problem with the way these artifacts are hosted vs. gradle expectations or the problem is on our end, which is why I've started a discussion topic rather than a bug report. Any suggestions very welcome. Thanks!

[lesserwhirls]

It looks like the build has defined the Unidata repo as:

    maven {
        url "https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/" //
    }

Can you try replacing that with:

    maven {
        url "https://artifacts.unidata.ucar.edu/repository/unidata-releases/"
    }

[james-d-brown]

Ah, much appreciated, lesserwhirls! Our build is now succeeding with the later deps. I owe you a beer :)

[lesserwhirls]

That's great news! Sonatype recently changed their licensing and the free version is based on usage. We were receiving 800k requests per day, which was well over their limit. It turned out that most of those hits were from other artifact severs proxying our server, as well as other project builds that were checking our artifacts server before maven central. That was causing hundreds of thousands of 404s, so we tightened down what requests would be allowed to reach our server. The end result is that we are now well under the limits, and will continue to be able to provide our artifacts through nexus. It looks like the artifacts server used to handle redirecting from https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases/ to https://artifacts.unidata.ucar.edu/repository/unidata-releases/, but our new apache rules don't let requests get that far, so that's why you started to see 403s. I didn't realize the server would do that, so we did not configure apache to handle that.

[james-d-brown]

Interesting, thanks for these details, which explain the behavior we were seeing :) All the best, James.

[james-d-brown]

Hi lesserwhirls,

I've been getting this again with recent builds, but with the updated repo address:

https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/cdm-s3/5.7.0/cdm-s3-5.7.0.pom

Stack trace from our gradle build, triggered by a github action:

A problem occurred evaluating root project 'wres'.
> Could not resolve all files for configuration ':wres-reading:runtimeClasspath'.
   > Could not resolve edu.ucar:cdm-core:5.7.0.
     Required by:
         project :wres-reading
      > Could not resolve edu.ucar:cdm-core:5.7.0.
         > Could not get resource 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/cdm-core/5.7.0/cdm-core-5.7.0.pom'.
            > Could not GET 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/cdm-core/5.7.0/cdm-core-5.7.0.pom'. Received status code 403 from server: Forbidden
   > Could not resolve edu.ucar:cdm-s3:5.7.0.
     Required by:
         project :wres-reading
      > Could not resolve edu.ucar:cdm-s3:5.7.0.
         > Could not get resource 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/cdm-s3/5.7.0/cdm-s3-5.7.0.pom'.
            > Could not GET 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/cdm-s3/5.7.0/cdm-s3-5.7.0.pom'. Received status code 403 from server: Forbidden

Do you have any other ideas?

The problem does not seem to be triggered under all circumstances. For example, I don't get a 403 when I visit that address with my browser (but that was also the case before). It is not triggered by a gradle build locally. It is triggered by a gradle build under a github action. I expect the behavior can be tied back to your apache rules.

Thanks!

[fredriksvendsen]

Same issue here (for the grib package), but I can also reproduce locally by deleting ~/.gradle first.

> Could not resolve all files for configuration ':db:compileClasspath'.
   > Could not resolve edu.ucar:grib:4.6.21.
     Required by:
         project :db
      > Could not resolve edu.ucar:grib:4.6.21.
         > Could not get resource 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/grib/4.6.21/grib-4.6.21.pom'.
            > Could not GET 'https://artifacts.unidata.ucar.edu/repository/unidata-releases/edu/ucar/grib/4.6.21/grib-4.6.21.pom'. Received status code 403 from server: Forbidden

[sbesson]

The OME Java projects which depend on NetCDF Java artifacts are facing similar issues since Monday 20/05/2025. 403 responses are being issued to requests while building using Maven and/or Gradle in environments (hosted Jenkins, GitHub Actions) that have been working previously.

Using https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases to https://artifacts.glencoesoftware.com/artifactory/unidata-releases in the repository URL declaration as suggested in #1432 (comment) does not resolve the issue in these environments as reported in the last comments.

We are aware that the Unidata team is currently working at minimal capacity and can only respond to the most critical issues - https://www.unidata.ucar.edu/blogs/news/entry/nsf-unidata-pause-in-most. We will likely switch to a mirror of these artifacts for now and reevaluate when there is some progress on this issue

[randyiamtheliquor]

I was coming here to report the same issue, but my maven build (unidata-releases repo) just started working! Anyone else pulling artifacts successfully again?

[james-d-brown]

Yes, also succeeding again for me!

[randyiamtheliquor]

Nice. Thank you to the unknown people keeping the lights on 🫡 I don't know where to send the beer but I'll figure it out!