I’m trying to convince the higher-ups at my work place to migrate to Apache Ivy. I’ve managed to get a few sandbox projects working using Ivy to power the build, and now I have a greenlight to put together a migration proposal.
We all agree on one thing: we don’t want to trust JARs that are located in public directories! I know, I know, a bit paranoid, yes. But we’d like to have a setup where we pull a JAR from a trusted source (either downloading it from the open source project itself, or most likely, gulp, a public repo), and use it for some time before we “certify” it (give it our blessing as a safe artifact to use).
Then we want to have a common repository for all JARs used by our many projects.
My original thinking was to place this repository up in version control (we have an SVN server). But I wasn’t sure what best practices dictate. It might make more sense to put our JARs on a file server and FTP to them in the Ivy script.
Either way, SVN (HTTPS) or FTP, all of our servers are authenticated. So, a small number of questions:
- Where should we be publishing all of our “certified” JARs (everything from `log4j` to any homegrown JARs we produce)? What do best practices dictate?
- The “ivyrep” resolver-type does not take username or passwd atrributes. If our “JAR server” (FTP, SVN, etc.) is authenticated, how do I configure the Ivy scripts to login?
Why not use something like Sonatype’s Nexus. I’ve seen it used for Maven, and I believe it’ll work for Ivy.
You can set it up to download from remote repositories into (say) a ‘test’ repository. You can then evaluate those .jars, and if they’re good, upload them into an ‘approved’ repository for general consumption. There’s some authentication surrounding this, but you’d have to evaluate that in greater depth. Certainly you can restrict the uploading into repositories via a username/password pair.