Maven and dependency on central servers

Hi, I'm new to maven, and I'm a bit reserved to trusting a
few  
centralized servers for something that's critical to a
project.

Since any host that downloads a project (say, from SVN) and
wants to  
build it, needs to download a number of Maven packages,
obviously  
there's a heavy dependency on the central maven server.

Yesterday when I started trying out Maven, I spent maybe 20
minutes  
waiting for the initial dependencies to be loaded from
repo.maven.org  
(at speeds of a few to a few thousand bytes/second), until I
found  
out how to use a mirror site.  The problem: there are only a
handful  
of mirror sites, and should they disappear (for any reason,
maybe the  
company/organisation losing interest / moving to another
build  
system) or be as overloaded/slow as the central server,
it'd be  
impossible to setup a new host and work on the project.

I've read through the docs a bit and found out that you can
set up  
your own servers, but my question: is there a list of what
packages/ 
dependencies the maven core uses, so that anybody who wants
a 100%  
reliable server can download anything that maven could ever
need  
(only the builtin modules, obviously; for everything else
you manage  
your own dependencies).

Is it a viable option to simply tar up the .m2 directory
after a few  
full project builds (so that hopefully all dependencies will
have  
been loaded).

This isn't a troll, I'm only genuinely afraid of trusting
a few  
centralized servers for a task that's needed for any new
machine to  
setup their system (especially after noticing last night,
how slow a  
server can be and what that means for getting to work).  A
big  
tarball/package would certainly be easier to deploy for an
organisation.

Best regards,
   Ulrich

------------------------------------------------------------
---------
To unsubscribe, e-mail: users-unsubscribemaven.apache.org
For additional commands, e-mail: users-helpmaven.apache.org

I am with you.  I tried building the test project, and it
failed on a few
files from the central repository.  Based on this post, I
switched to a
mirror and got what I needed successfully.  In my mind this
bodes very ill
of this approach if the maven project can't keep it's
central repository
servers online and available.

Alex.

On 7/28/06, Ulrich Hobelmann <u.hobelmannweb.de> wrote:
>
> Hi, I'm new to maven, and I'm a bit reserved to
trusting a few
> centralized servers for something that's critical to a
project.
>
> Since any host that downloads a project (say, from SVN)
and wants to
> build it, needs to download a number of Maven packages,
obviously
> there's a heavy dependency on the central maven
server.
>
> Yesterday when I started trying out Maven, I spent
maybe 20 minutes
> waiting for the initial dependencies to be loaded from
repo.maven.org
> (at speeds of a few to a few thousand bytes/second),
until I found
> out how to use a mirror site.  The problem: there are
only a handful
> of mirror sites, and should they disappear (for any
reason, maybe the
> company/organisation losing interest / moving to
another build
> system) or be as overloaded/slow as the central server,
it'd be
> impossible to setup a new host and work on the project.
>
> I've read through the docs a bit and found out that
you can set up
> your own servers, but my question: is there a list of
what packages/
> dependencies the maven core uses, so that anybody who
wants a 100%
> reliable server can download anything that maven could
ever need
> (only the builtin modules, obviously; for everything
else you manage
> your own dependencies).
>
> Is it a viable option to simply tar up the .m2
directory after a few
> full project builds (so that hopefully all dependencies
will have
> been loaded).
>
> This isn't a troll, I'm only genuinely afraid of
trusting a few
> centralized servers for a task that's needed for any
new machine to
> setup their system (especially after noticing last
night, how slow a
> server can be and what that means for getting to work).
 A big
> tarball/package would certainly be easier to deploy for
an organisation.
>
> Best regards,
>    Ulrich
>
>
------------------------------------------------------------
---------
> To unsubscribe, e-mail: users-unsubscribemaven.apache.org
> For additional commands, e-mail: users-helpmaven.apache.org
>
>

Hi there,

If you read the "Better builds with maven" book
you will see that you can 
easily set up your own mirror yourself (typically a mirror
that is only 
used by you coworkers).

There are other options too (see book)

Stefan

"Alex Turner" <armtukgmail.com> skrev
28.07.2006 13:20:50:

> I am with you.  I tried building the test project, and
it failed on a 
few
> files from the central repository.  Based on this post,
I switched to a
> mirror and got what I needed successfully.  In my mind
this bodes very 
ill
> of this approach if the maven project can't keep it's
central repository
> servers online and available.
> 
> Alex.
> 
> On 7/28/06, Ulrich Hobelmann <u.hobelmannweb.de> wrote:
> >
> > Hi, I'm new to maven, and I'm a bit reserved to
trusting a few
> > centralized servers for something that's critical
to a project.
> >
> > Since any host that downloads a project (say, from
SVN) and wants to
> > build it, needs to download a number of Maven
packages, obviously
> > there's a heavy dependency on the central maven
server.
> >
> > Yesterday when I started trying out Maven, I spent
maybe 20 minutes
> > waiting for the initial dependencies to be loaded
from repo.maven.org
> > (at speeds of a few to a few thousand
bytes/second), until I found
> > out how to use a mirror site.  The problem: there
are only a handful
> > of mirror sites, and should they disappear (for
any reason, maybe the
> > company/organisation losing interest / moving to
another build
> > system) or be as overloaded/slow as the central
server, it'd be
> > impossible to setup a new host and work on the
project.
> >
> > I've read through the docs a bit and found out
that you can set up
> > your own servers, but my question: is there a list
of what packages/
> > dependencies the maven core uses, so that anybody
who wants a 100%
> > reliable server can download anything that maven
could ever need
> > (only the builtin modules, obviously; for
everything else you manage
> > your own dependencies).
> >
> > Is it a viable option to simply tar up the .m2
directory after a few
> > full project builds (so that hopefully all
dependencies will have
> > been loaded).
> >
> > This isn't a troll, I'm only genuinely afraid of
trusting a few
> > centralized servers for a task that's needed for
any new machine to
> > setup their system (especially after noticing last
night, how slow a
> > server can be and what that means for getting to
work).  A big
> > tarball/package would certainly be easier to
deploy for an 
organisation.
> >
> > Best regards,
> >    Ulrich
> >
> >
------------------------------------------------------------
---------
> > To unsubscribe, e-mail: users-unsubscribemaven.apache.org
> > For additional commands, e-mail: users-helpmaven.apache.org
> >
> >

On Fri, July 28, 2006 1:06 pm, Ulrich Hobelmann wrote:

> This isn't a troll, I'm only genuinely afraid of
trusting a few
> centralized servers for a task that's needed for any
new machine to
> setup their system (especially after noticing last
night, how slow a
> server can be and what that means for getting to work).
 A big
> tarball/package would certainly be easier to deploy for
an organisation.

This is only a once off problem - now that you've gone
through the
doanloading pain, there is no need to do it again, unless
you decide to
add or change versions of dependancies.

The full repository is quite a number of GB in size, making
a tarball
available of it is unlikely to be efficient when you could
simply mirror
the repository yourself from time to time, removing the risk
of the repo
"going away".

If the central repos go down, you lose the auto-download
capability, but
there is nothing stopping you from resolving the
dependencies manually
(apart from the annoyance of having to do so).

Regards,
Graham
--



------------------------------------------------------------
---------
To unsubscribe, e-mail: users-unsubscribemaven.apache.org
For additional commands, e-mail: users-helpmaven.apache.org

Hi,

Making a full repository mirror is not an option. What you
need is a
proxy for Maven.

You should try Proximity:
http://proximit
y.abstracthorizon.org/

Proximity protects you from repo blackouts, inconsistent
repositories,
sporadic ibiblios HTTP 500 errors and also speeds the build
time.

Organizations should indefinitely not depend on centralized
servers,
they should build their own inhouse repositories (proxied
reposes +
hosted reposes).


Have fun,
~t~

On 7/28/06, Graham Leggett <minfrinsharp.fm> wrote:
> On Fri, July 28, 2006 1:06 pm, Ulrich Hobelmann wrote:
>
> > This isn't a troll, I'm only genuinely afraid of
trusting a few
> > centralized servers for a task that's needed for
any new machine to
> > setup their system (especially after noticing last
night, how slow a
> > server can be and what that means for getting to
work).  A big
> > tarball/package would certainly be easier to
deploy for an organisation.
>
> This is only a once off problem - now that you've gone
through the
> doanloading pain, there is no need to do it again,
unless you decide to
> add or change versions of dependancies.
>
> The full repository is quite a number of GB in size,
making a tarball
> available of it is unlikely to be efficient when you
could simply mirror
> the repository yourself from time to time, removing the
risk of the repo
> "going away".
>
> If the central repos go down, you lose the
auto-download capability, but
> there is nothing stopping you from resolving the
dependencies manually
> (apart from the annoyance of having to do so).
>
> Regards,
> Graham
> --
>
>
>
>
------------------------------------------------------------
---------
> To unsubscribe, e-mail: users-unsubscribemaven.apache.org
> For additional commands, e-mail: users-helpmaven.apache.org
>
>

------------------------------------------------------------
---------
To unsubscribe, e-mail: users-unsubscribemaven.apache.org
For additional commands, e-mail: users-helpmaven.apache.org

On Jul 28, 2006, at 1:28 PM, Graham Leggett wrote:

> On Fri, July 28, 2006 1:06 pm, Ulrich Hobelmann wrote:
>
>> This isn't a troll, I'm only genuinely afraid of
trusting a few
>> centralized servers for a task that's needed for
any new machine to
>> setup their system (especially after noticing last
night, how slow a
>> server can be and what that means for getting to
work).  A big
>> tarball/package would certainly be easier to deploy
for an  
>> organisation.
>
> This is only a once off problem - now that you've gone
through the
> doanloading pain, there is no need to do it again,
unless you  
> decide to
> add or change versions of dependancies.

Ok, that sounds reasonable.

Could I simply tar up the .m2 directory, or is there
anything in it  
that's host-specific?  (so a new machine could simply copy
the .m2  
and start building; especially for a portable machine I'd
hate to be  
missing a dependency...).

> The full repository is quite a number of GB in size,
making a tarball
> available of it is unlikely to be efficient when you
could simply  
> mirror
> the repository yourself from time to time, removing the
risk of the  
> repo
> "going away".
>
> If the central repos go down, you lose the
auto-download  
> capability, but
> there is nothing stopping you from resolving the
dependencies manually
> (apart from the annoyance of having to do so).

Ok, thanks.



------------------------------------------------------------
---------
To unsubscribe, e-mail: users-unsubscribemaven.apache.org
For additional commands, e-mail: users-helpmaven.apache.org

I agree with what you are saying. Luckily there is an
answer: setup
your own internal repository. There are a few options here,
I'm sure
someone else on the list can provide you with more details
as I'm a
maven newb. These references might help:

http://maven.apache.org/guides/intr
oduction/introduction-to-repositories.html
http://maven-proxy.c
odehaus.org/
http://proximit
y.abstracthorizon.org/

Also there is some discussion of this in the "Better
Builds With Maven" guide.


On 7/28/06, Graham Leggett <minfrinsharp.fm> wrote:
> On Fri, July 28, 2006 1:06 pm, Ulrich Hobelmann wrote:
>
> > This isn't a troll, I'm only genuinely afraid of
trusting a few
> > centralized servers for a task that's needed for
any new machine to
> > setup their system (especially after noticing last
night, how slow a
> > server can be and what that means for getting to
work).  A big
> > tarball/package would certainly be easier to
deploy for an organisation.
>
> This is only a once off problem - now that you've gone
through the
> doanloading pain, there is no need to do it again,
unless you decide to
> add or change versions of dependancies.
>
> The full repository is quite a number of GB in size,
making a tarball
> available of it is unlikely to be efficient when you
could simply mirror
> the repository yourself from time to time, removing the
risk of the repo
> "going away".
>
> If the central repos go down, you lose the
auto-download capability, but
> there is nothing stopping you from resolving the
dependencies manually
> (apart from the annoyance of having to do so).
>
> Regards,
> Graham
> --
>
>
>
>
------------------------------------------------------------
---------
> To unsubscribe, e-mail: users-unsubscribemaven.apache.org
> For additional commands, e-mail: users-helpmaven.apache.org
>
>

------------------------------------------------------------
---------
To unsubscribe, e-mail: users-unsubscribemaven.apache.org
For additional commands, e-mail: users-helpmaven.apache.org

We actually had to make a maven distribution like that for
an offline 
workshop. It worked perfectly tarring up everything.

Stefan


u.hobelmannweb.de skrev 28.07.2006 14:04:23:

> On Jul 28, 2006, at 1:28 PM, Graham Leggett wrote:
> 
> > On Fri, July 28, 2006 1:06 pm, Ulrich Hobelmann
wrote:
> >
> >> This isn't a troll, I'm only genuinely
afraid of trusting a few
> >> centralized servers for a task that's needed
for any new machine to
> >> setup their system (especially after noticing
last night, how slow a
> >> server can be and what that means for getting
to work).  A big
> >> tarball/package would certainly be easier to
deploy for an 
> >> organisation.
> >
> > This is only a once off problem - now that you've
gone through the
> > doanloading pain, there is no need to do it again,
unless you 
> > decide to
> > add or change versions of dependancies.
> 
> Ok, that sounds reasonable.
> 
> Could I simply tar up the .m2 directory, or is there
anything in it 
> that's host-specific?  (so a new machine could simply
copy the .m2 
> and start building; especially for a portable machine
I'd hate to be 
> missing a dependency...).
> 
> > The full repository is quite a number of GB in
size, making a tarball
> > available of it is unlikely to be efficient when
you could simply 
> > mirror
> > the repository yourself from time to time,
removing the risk of the 
> > repo
> > "going away".
> >
> > If the central repos go down, you lose the
auto-download 
> > capability, but
> > there is nothing stopping you from resolving the
dependencies manually
> > (apart from the annoyance of having to do so).
> 
> Ok, thanks.
> 
> 
> 
>
------------------------------------------------------------
---------
> To unsubscribe, e-mail: users-unsubscribemaven.apache.org
> For additional commands, e-mail: users-helpmaven.apache.org
> 

Ulrich Hobelmann wrote:

> Could I simply tar up the .m2 directory, or is there
anything in it 
> that's host-specific?  (so a new machine could simply
copy the .m2 and 
> start building; especially for a portable machine I'd
hate to be missing 
> a dependency...).

I've moved around copies of .m2 and .maven from machine to
machine with 
no problems, mainly to save a team of developers having to
download 
dependencies to each developer's machines.

Regards,
Graham
--