Mailing-List: contact ivy-user-help@ant.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ivy-user@ant.apache.org
Received-SPF: pass (athena.apache.org: domain of ray.racine@gmail.com
 designates 74.125.44.158 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=hR7sxSJeJzgKjeSb9858dvwN0MjFsn3v2rlAL+VsCrk2Ds/z/BTgVV9R+t4r6j7ER8
         C8z2u7BP05YVP98+lXtXBmLKo8V9trmWqm9m2XAjFBK+mxzBvhSP+vd+gEKfMqapwfD1
         LE77oDNItA6TCymGv0ZaR9qEQ5xumwQ2nTUqE=
MIME-Version: 1.0
Date: Wed, 15 Apr 2009 13:16:47 -0400
Message-ID: <ec7b3b810904151016s415cb1dama713d23e1882a6b3@mail.gmail.com>
Subject: Professional Repository - Artifact Verification
From: Ray Racine <ray.racine@gmail.com>
To: ivy-user@ant.apache.org
Content-Type: multipart/alternative; boundary=00163630f4e9ccc5b504679b1c22

--00163630f4e9ccc5b504679b1c22
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Trying to understand the Ivy way of setting up
internal/shared/professional/enterprise repositories.

I've looked through the Best Practices, examples etc. and the one thing I
keep looking for is the verification aspect.  Its one of those things "you
know it has to be there somewhere" but I can't find it.  Let's say I want to
create an internal repository and as part of the process verify the jars
using PGP, MD5 or SHA-1 sigs.   Is this something supported by Ivy or are
there other Ant tasks and scripts everyone is using that support this?
Right now the best I can come up with would be something like this.

 - Create a local Stage Repository and populate it from public (Maven et al)
repos via an Ant script with itemized Install tasks for each artifact.
 - Manually obtain sigs or keys from a non-mirror and verify a jar
one-by-one.
 - Use another Ant script to move via an Install task a verified jar into
MyEnterpriseRepo.
 - Then to avoid all this manual work, start building a tedious set of Ant
scripts to fetch KEYS etc via fetch tasks and verify all Stage Repo.
artifacts etc...

What I've been searching for is some settings capability where for each
artifact I can tell Ivy the expect PGP or SHA-1 and avoid the Stage
Repository, in other words, Ivy will refuse to install an artifact info
MyEnterpriseRepo which fails to verify.

How is everyone dealing with the verification aspect??

Thanks,

Ray

--00163630f4e9ccc5b504679b1c22--