I solved this in a different way. Do a one-time build to prime the ~/.ivy2 directory and/or copy this from a machine with Internet access.
I set the mvn.repo property in ~/build.properties (or pass it in as a -D option). Note that in common this property is called mvnrepo (no dot).
Then I have two file:
The former is needed for all targets, the latter only if you want to use the mvn-install or mvn-publish targets.
One other bootstrap problem with this is that the ivy and tasks cannot be found. I therefore manually copy both jars into hadoop-common/hdfs/ivy (also hadoop-common/common/ivy and hadoop-common/mapreduce). In Jenkins I have a simple build step for this.
There is still a problem though, and that is that in the compile-contrib target a subant call is made. That does not pass along properties. That is problematic even when one sets other properties (for example hadoop-common.version. I'll file a separate bug for this.