Hmm, I might have figured it out. Is there a chance that tools.deps doesn't handle pom <distributionManagement> <relocation>s? It looks like Debian currently has a plexus-component-annotations-1.5.5.pom in /usr/share/maven-repo (in libplexus-component-annotations-java) with a relocation section that points to the "debian" version, which does exist (and is actually 2.1.1), but the deb build currently decides to try to download 1.5.5.