maven-deploy-plugin version 3.0.0-M1 deploy fails with 401 ReasonPhrase: Unauthorized

Symptom

Maven 2 artifact deployments specifically using the 3.0.0-M1 version of the maven-deploy-plugin may fail with a message:

ArtifactDeployerException: Failed to deploy artifacts: Could not transfer artifact 

and a reason:

Return code is: 401, ReasonPhrase: Unauthorized.

Cause

A bug has been reported against the maven-deploy-plugin with this new problem:

https://issues.apache.org/jira/browse/MDEPLOY-244

The 3.0.0-M1 release was late September 2018.

The latest previous release of the maven-deploy-plugin was over 4 years prior. The latest plugin release version will automatically be used if the project POM or Maven invocation does not explicitly state a version of the plugin to use.

Workaround #1

Best practices to ensure repeatable Maven builds require locking down Maven plugin versions using versions defined in the pluginManagement section of project parent POM files.

https://maven.apache.org/pom.html#Plugin_Management

The last release version of the maven-deploy-plugin prior to 3.0.0-M1 without this bug was version 2.8.2.

To enforce an earlier version of the maven-deploy-plugin be used, define such a POM section such as below:

<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
                      https://maven.apache.org/xsd/maven-4.0.0.xsd">
  ...
  <build>
    ...
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>2.8.2</version>
        </plugin>
      </plugins>
    </pluginManagement>
    ...
  </build>
</project>

If you are invoking the deploy-file goal at invocation time, then use the full plugin coordinate to enforce the plugin version:

> mvn org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy-file ...

Workaround #2

The maintainers of the maven-deploy-plugin have acknowledged the regression and provided advice on how to change the deployment URL so that the latest releases of the plugin will work. See this comment.