pin maven from echo (#504)

Author: cx-aniket-shinde

.github/workflows/release.yml

@@ -162,10 +162,9 @@ jobs:
         # Maven 3.10+ breaks central-publishing-maven-plugin bundling (upstream bug)
         run: |
           MAVEN_VERSION=3.9.16
-          curl -fsSL -o /tmp/maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
-          curl -fsSL -o /tmp/maven.tar.gz.sha512 "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz.sha512"
-          echo "$(cat /tmp/maven.tar.gz.sha512)  /tmp/maven.tar.gz" | sha512sum -c -
-          sudo tar -xzf /tmp/maven.tar.gz -C /opt
+          # Resolved through the echo-repo mirror configured in ~/.m2/settings.xml above
+          mvn -B -q dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
           echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> $GITHUB_PATH
 
       - name: Update the POM version.