From mobile apps to microservices, from small startups to big enterprises, Gradle helps teams build, automate and deliver better software, faster.

Gradle Community

to be clear, the artifact _is_ available, but I'm not sure where this `.module` postfix is coming from.

(list of files:
```jackson-datatype-joda-2.13.4-javadoc.jar
jackson-datatype-joda-2.13.4-javadoc.jar.asc
jackson-datatype-joda-2.13.4-sources.jar
jackson-datatype-joda-2.13.4-sources.jar.asc
jackson-datatype-joda-2.13.4.jar
jackson-datatype-joda-2.13.4.jar.asc
jackson-datatype-joda-2.13.4.pom
jackson-datatype-joda-2.13.4.pom.asc```
)

See <https://docs.gradle.org/current/userguide/publishing_gradle_module_metadata.html>

For some reason, the POM contains the "marker comment" saying there's a companion module metadata file (<https://repo.maven.apache.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-joda/2.13.4/jackson-datatype-joda-2.13.4.pom>), but that file wasn't actually published.

I guess somehow the `.module` file could be published there

or specify the metadata repo to be something external?

I believe that was a "release bug" on Jackson's side.
Your first issue here IMO is the 504 instead of 404.
If that's not enough, there's not much more you can do, besides disabling module metadata entirely: <https://docs.gradle.org/current/userguide/declaring_repositories.html#sec:supported_metadata_sources>

technically a 404 but I guess jfrog treats it as a 403 instead.

That's still a very big difference.
404 means "not found" and Gradle would handle that gracefully and ignore the marker in the POM as far as I remember.
403 means "forbidden" which means "the file is there but I don't give it to you" in which case Gradle then obviously fails.

It would be optimal if you could teach Artifactory to give a 404, not a 403.

<https://jfrog.atlassian.net/browse/RTFACT-8765> suggests you can now configure this to be different.
You most probably have a virtual repository that aggregates several physical repositories and your user does not have access for all those.
Then by default if a file is not found in the repositories you have access to, you get a 403 as it cannot look in the other repositories.

So either change that setting to return 404 instead, or do not use a virtual repository with repositories you have no access to.

&gt; I believe that was a "release bug" on Jackson's side.
Yes. Afaik this was a publishing setup problem in Jackson which is fixed in newer versions. It's fixed for instance in `2.13.5`

What's weird with this issue is that I was using these versions for a while, and it just suddenly popped out. What could be a plausible explanation for that (_there were NO dependency version changes in the meantime and 5 days ago the same build passed) ?_

I think that's the error code thing discussed above. Depending on the error code, Gradle might just ignore the missing file (and use the POM metadata instead). Maybe something in your repository config changed?

Yeah, I guess there was maybe some physical repository added to the virtual repository you are using for which you have no access right, like I described above.