I’d like to have a setup where developers can resolve/retrieve dependencies from a URL Resolver (a remote, in-house server hosting our repo) but cannot publish to it (for security and code integrity reasons).
However, for their Ivy clients to “see” the remote repo so they can pull dependencies down off of it, I need to expose the URL in the resolve/retrieve patterns inside our Ant builds. This includes the username & password!
How do I give them “read” (resolution) access, but not “write” (publishing) access?!?!
Use a repository manager like Nexus, Archiva or Artifactory that has a security model for the repository access. It will allow you to create a read only user for the repository that you give to the developers.