-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Give specific company repositories URL instead of group https://invesdwin.de/repo/invesdwin-oss-remote/ #6
Comments
Also linking with the main topic: invesdwin/invesdwin-instrument#17 Notify me if anything else is missing/needed. |
Answer is full and great. Well, I actually was looking only for Python usage point of view. But there are 20+ repositories, that maybe are not on Central, and huge number of dependencies #2 |
Yes, the platform itself is quite large. But when you look at the specific dependencies of invesdwin-context-python, most if not everything should be available on central: So just go from the depencies outside, not from our list of repos to the inside. Then the configuration management should be doable just for this module. ;) |
The #8 is solved, now artefacts are downloadable
But there is (what I see) problem that invesdwin-oss-remote is actually group all all repositories
and contains everything
https://invesdwin.de/nexus/service/rest/repository/browse/invesdwin-oss-remote/
While I think for end-user you should only give own
release
andsnapshot
repositories(or maybe group of these 2, but this is not common )
There is security threat to use https://invesdwin.de/repo/invesdwin-oss-remote/ as maven will download all artifacts from there instead of Central.
I am sure, you do proper work to ensure that your Nexus jars are safe and not tempered with.
But it is against security to recommend to anyone to download common open source jars from 3rd party repositories
as in the end, there is no way to tell, where exactly specific jar came from.
Or simpler other reason is that https://invesdwin.de/repo/invesdwin-oss-remote/ may be slower, than Maven Central for some part of users.
The text was updated successfully, but these errors were encountered: