From 2f13520c812a020687cd7d77faafad634202d611 Mon Sep 17 00:00:00 2001
From: Aniket Shinde <aniket.shinde@checkmarx.com>
Date: Thu, 15 Oct 2026 16:20:30 +0530
Subject: [PATCH] pin maven from echo

---
 .github/workflows/release.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ccd5b25..1a21b6f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -162,10 +162,9 @@ jobs:
         # Maven 3.10+ breaks central-publishing-maven-plugin bundling (upstream bug)
         run: |
           MAVEN_VERSION=3.9.16
-          curl -fsSL -o /tmp/maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
-          curl -fsSL -o /tmp/maven.tar.gz.sha512 "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz.sha512"
-          echo "$(cat /tmp/maven.tar.gz.sha512)  /tmp/maven.tar.gz" | sha512sum -c -
-          sudo tar -xzf /tmp/maven.tar.gz -C /opt
+          # Resolved through the echo-repo mirror configured in ~/.m2/settings.xml above
+          mvn -B -q dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
           echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> $GITHUB_PATH
 
       - name: Update the POM version.