Remoting/use maven mirror

build-support/docker/remote_execution/Dockerfile

@@ -44,3 +44,5 @@ RUN ${PYENV_BIN} install ${PYTHON_37_VERSION}
 ENV PATH "${PYENV_ROOT}/versions/${PYTHON_27_VERSION}/bin:${PATH}"
 ENV PATH "${PYENV_ROOT}/versions/${PYTHON_36_VERSION}/bin:${PATH}"
 ENV PATH "${PYENV_ROOT}/versions/${PYTHON_37_VERSION}/bin:${PATH}"
+
+RUN touch /PANTS_GCP_REMOTE && chmod 755 /PANTS_GCP_REMOTE

build-support/ivy/ivysettings.xml

@@ -26,6 +26,13 @@ Licensed under the Apache License, Version 2.0 (see LICENSE).
            This can lead to jars downloading without their transitive deps which leads
            to confusing failures later when classpaths are constructed and used.
            We setup the maven central resolver to require successful pom downloads here. -->
+
+      <!-- First try RBE's maven central mirror, as we can get throttled by
+           maven central due to all RBE traffic appearing to them as coming from a single IP.
+           There's no harm in trying this even outside RBE, as it is world-visible. -->
+      <ibiblio name="maven-central-mirror" m2compatible="true" descriptor="required"
+               root="https://maven-central.storage-download.googleapis.com/repos/central/data"/>
+
       <ibiblio name="maven-central" m2compatible="true" descriptor="required"/>
 
       <!-- The mvn standard local filesystem repo/cache -->

build-support/ivy/remote.ivysettings.xml

@@ -0,0 +1,46 @@
+<?xml version="1.0"?>
+<!--
+Copyright 2019 Pants project contributors (see CONTRIBUTORS.md).
+Licensed under the Apache License, Version 2.0 (see LICENSE).
+-->
+
+<ivysettings>
+  <settings defaultResolver="pants-chain-repos-mirror"/>
+
+  <property name="m2.repo.relpath" value="[organisation]/[module]/[revision]"/>
+  <property name="m2.repo.pom" value="${m2.repo.relpath}/[module]-[revision].pom"/>
+  <property name="m2.repo.artifact"
+            value="${m2.repo.relpath}/[artifact]-[revision](-[classifier]).[ext]"/>
+  <property name="m2.repo.dir" value="${user.home}/.m2/repository" override="false"/>
+  <property name="kythe.artifact" value="[organisation]/[artifact]/[revision]/[artifact]-[revision].[ext]"/>
+  <!-- for retrieving jacoco snapshot, remove when a version containing cli is released -->
+  <!-- see https://github.com/pantsbuild/pants/issues/5010 -->
+  <property name="sonatype.nexus.snapshots.url" value="https://oss.sonatype.org/content/repositories/snapshots/" />
+
+  <properties environment="env"/>
+
+  <resolvers>
+    <!--
+    Identical to ivysettings.xml, except we point remote execution at the RBE maven central mirror
+    to avoid DDOSing maven central. -->
+    <chain name="pants-chain-repos-mirror" returnFirst="true">
+      <ibiblio
+              name="maven-central-mirror"
+              m2compatible="true"
+              descriptor="required"
+              root="https://maven-central.storage-download.googleapis.com/repos/central/data"/>
+
+      <!-- The mvn standard local filesystem repo/cache -->
+      <filesystem name="local.m2" m2compatible="true" local="true" checkmodified="true">
+        <ivy pattern="${m2.repo.dir}/${m2.repo.pom}"/>
+        <artifact pattern="${m2.repo.dir}/${m2.repo.artifact}"/>
+      </filesystem>
+
+      <!-- Custom repo for Kythe jars, as Google don't currently publish them anywhere. -->
+      <url name="toolchainlabs/binhost">
+        <artifact pattern="https://github.com/toolchainlabs/binhost/raw/master/${kythe.artifact}" />
+      </url>
+    </chain>
+
+  </resolvers>
+</ivysettings>

pants.ini

@@ -451,6 +451,15 @@ enable_libc_search: True
 [sourcefile-validation]
 config: @build-support/regexes/config.yaml
 
+[coursier]
+repos: [
+    # Google RBE maven central mirror that avoids throttling by maven central.
+    'https://maven-central.storage-download.googleapis.com/repos/central/data',
+    'https://repo1.maven.org/maven2',
+    # Custom repo for Kythe jars, as Google doesn't currently publish them anywhere.
+    'https://raw.githubusercontent.com/toolchainlabs/binhost/master/'
+  ]
+
 [cache.resolve.coursier]
 # Only use local artifact for coursier because the cache content contains abs path
 # and is not portable. That said, if remote cache is enabled, this would not break

pants.remote.ini

@@ -20,7 +20,7 @@ remote_instance_name: projects/pants-remoting-beta/instances/default_instance
 remote_execution_extra_platform_properties: [
     # This allows network requests, e.g. to resolve dependencies with Pex.
     "dockerNetwork=standard",
-    "container-image=docker://gcr.io/pants-remoting-beta/rbe-remote-execution@sha256:5d818cd71c9180d977e16ca7a20e90ced14211621b69fe1d6c3fc4c42c537a14",
+    "container-image=docker://gcr.io/pants-remoting-beta/rbe-remote-execution@sha256:dbc9005efdcf30f9e22b450c2ee0aef50077ff98dee84a9922e63f905aff926e",
   ]
 
 # This should correspond to the number of workers running in Google RBE. See
@@ -32,6 +32,11 @@ process_execution_speculation_strategy: none
 # p95 of RBE appears to be ~ 2 seconds, but we need to factor in local queue time which can be much longer, but no metrics yet.
 process_execution_speculation_delay: 15
 
+# DRY up maven central mirror setup in variables used below.
+maven_central_mirror_root_url: https://maven-central.storage-download.googleapis.com/repos/central/data
+maven_central_mirror_ivy_bootstrap_jar_url: %(maven_central_mirror_root_url)s/org/apache/ivy/ivy/2.4.0/ivy-2.4.0.jar
+maven_central_mirror_ivy_settings: %(pants_supportdir)s/ivy/remote.ivysettings.xml
+
 [python-setup]
 # TODO(#7735): This config is not ideal, that we must specify the PATH for both local and remote
 # platforms. This should be replaced by a proper mechanism to differentiate between the two.
@@ -47,3 +52,31 @@ interpreter_search_paths: [
 [python-native-code]
 ld_flags: []
 cpp_flags: []
+
+# Note that the logic below is repeated in jvm_task_test_base.py. See there for details.
+# If you set remote-specific ivy/coursier options here, set them there as well.
+
+[ivy]
+bootstrap_jar_url: %(maven_central_mirror_ivy_bootstrap_jar_url)s
+bootstrap_ivy_settings: %(maven_central_mirror_ivy_settings)s
+ivy_settings: %(maven_central_mirror_ivy_settings)s
+
+[ivy.outdated]
+bootstrap_jar_url: %(maven_central_mirror_ivy_bootstrap_jar_url)s
+bootstrap_ivy_settings: %(maven_central_mirror_ivy_settings)s
+ivy_settings: %(maven_central_mirror_ivy_settings)s
+
+[ivy.outdated.ivy]
+bootstrap_jar_url: %(maven_central_mirror_ivy_bootstrap_jar_url)s
+bootstrap_ivy_settings: %(maven_central_mirror_ivy_settings)s
+ivy_settings: %(maven_central_mirror_ivy_settings)s
+
+[coursier]
+repos: [
+    # Google RBE maven central mirror that avoids DDOSing maven central.
+    '%(maven_central_mirror_root_url)s',
+
+    # Custom repo for Kythe jars, as Google doesn't currently publish them anywhere.
+    'https://raw.githubusercontent.com/toolchainlabs/binhost/master/'
+  ]
+

src/python/pants/testutil/jvm/BUILD

@@ -42,6 +42,7 @@ python_library(
   name='jvm_task_test_base',
   sources=['jvm_task_test_base.py'],
   dependencies=[
+    'build-support/ivy',
     'src/python/pants/backend/jvm/tasks:classpath_products',
     'src/python/pants/testutil/subsystem',
     'src/python/pants/testutil:task_test_base',

src/python/pants/testutil/jvm/jvm_task_test_base.py

@@ -22,6 +22,21 @@ def setUp(self):
     super().setUp()
     init_subsystem(JvmResolveSubsystem)
     self.set_options_for_scope('resolver', resolver='ivy')
+    if os.path.isfile('/PANTS_GCP_REMOTE'):
+      # Use the GCP maven mirrors, so we don't get throttled for DOSing maven central.
+      # Note that this recapitulates the logic in pants.remote.ini. Unfortunately we
+      # can't access the real options inside tests, and plumbing these through everywhere
+      # they're needed is prohibitive. So we repeat the logic here.
+      maven_central_mirror_root_url = 'https://maven-central.storage-download.googleapis.com/repos/central/data'
+      maven_central_mirror_ivy_bootstrap_jar_url = f'{maven_central_mirror_root_url}/org/apache/ivy/ivy/2.4.0/ivy-2.4.0.jar'
+      maven_central_mirror_ivy_settings = 'build-support/ivy/remote.ivysettings.xml'
+
+      self.set_options_for_scope('coursier', repos=[maven_central_mirror_root_url])
+      for scope in ['ivy', 'ivy.outdated', 'ivy.outdated.ivy']:
+        self.set_options_for_scope(scope,
+                                   bootstrap_jar_url=maven_central_mirror_ivy_bootstrap_jar_url,
+                                   bootstrap_ivy_settings=maven_central_mirror_ivy_settings,
+                                   ivy_settings=maven_central_mirror_ivy_settings)
 
   def populate_runtime_classpath(self, context, classpath=None):
     """