Mailing-List: contact dev-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Received-SPF: pass (athena.apache.org: domain of bimargulies@gmail.com
 designates 74.125.44.155 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=ROhG7AOgjkdiPke4trv6WE4YQwRj24o334GkdmRXYxh6T3t+Tuf4tbMJIqdLJxlSqA
         nJJxVl7UdN//j2jIqgsUzED/ZfPHSOuy9kTocaaUqJt2m4cNzP6qQYJHI4aRltoU1FK0
         MYDvPFXq7l2sMk8e48GFng70b92M88Igs1kpI=
MIME-Version: 1.0
In-Reply-To: <200902191338.50203.dkulp@apache.org>
References: <200902191338.50203.dkulp@apache.org>
Date: Thu, 19 Feb 2009 13:58:43 -0500
Message-ID: <61b5d9410902191058p73f761bdy16875d8dd45696b6@mail.gmail.com>
Subject: Re: [DISCUSS] Use Nexus for releases and/or snapshots?
From: Benson Margulies <bimargulies@gmail.com>
To: dev@cxf.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

I'm generally positive on this. I've got Nexus deployed here at Basis
with reasonable results.

I don't like the use of HTTP Basic authentication which requires
putting a password into the maven settings.xml. Is that what we'd be
faced with, or is your remark about the certificate a reflection of a
plan to allow cert-based auth for deployment? If so, I want to learn
how to do it, I want to do it here.

Nexus will manage artifacts on 'any old file system'. Why didn't ASF
infra arrange for Nexus to just colonize the existing real estate to
keep the URLs? But I don't object to the change.

On Thu, Feb 19, 2009 at 1:38 PM, Daniel Kulp <dkulp@apache.org> wrote:
>
> Some of you may be aware that the Maven team (actually Sonatype) has installed
> Nexus repository manager onto a zone at http://repository.apache.org.    Thus,
> projects are now being given the option to use the Nexus repository instead of
> the stuff on people.apache.org for things like snapshots and/or releases.
>
> One main advantage is that it uses HTTPs for deploys.   No futzing with
> ssh/scp to get deploys working.   You need to put a setting or two in your
> settings.xml file for auth info, but that's it.  The deploys will just work.
>
> From a release perspective, it also supports easy staging and promotion.
> When a release is deployed, it goes into a staging area automatically.   We
> then call the vote and if the vote passes, it's a push button promotion to
> deploy it to central.   Nexus handles all the metadata and such.   You don't
> need the maven-stage-plugin anymore.
>
>
> Now for the downsides:
> 1) The https self signed cert they currently use requires some work to embed
> it into your jre keystore.   They've asked for a real cert, but haven't gotten
> it yet.
>
> 2) Requires a little user management to put all of use into the "cxf" group
> (if only Apache had ldap....), but Sonatype and the Maven PMC is willing to
> manage that.
>
> 3) User impact:  if we decide that snapshots should go to nexus (we could just
> do releases), users that use the snapshots would need to change their URL's to
> grab from the new URL.     The links on our wiki would need to change as well.
>
> 4) Obviously, our release procedures wiki page would need major updating.
>
> 5) Learning curve: something new.   You can see the maven release docs:
> http://maven.apache.org/developers/release/releasing.html
> for a kind of walkthrough of how it would work. (with screen shots!)
>
>
> Anyway, I'd like to hear others thoughts.    It MOSTLY applies to myself and
> Willem as we're the only ones that have done releases.   However, the snapshot
> stuff applies to Benson and a couple others as well.
>
> --
> Daniel Kulp
> dkulp@apache.org
> http://www.dankulp.com/blog
>