14 ms·
Since those are proxy caches, they don't provide repeatable builds. The referred to release can be changed without your knowledge and Nexus will happily serve
by jpollock 10y ago
Since those are proxy caches, they don't provide repeatable builds. The referred to release can be changed without your knowledge and Nexus will happily serve that to you as correct.
- niftich 10y agoI don't follow. I shouldn't have mentioned Nexus as I'm a lot more familiar with Archiva. But, - if the release of the same version was changed upstream, and you want this change to be picked up, that's not a repeatable build anyway. - if the release was changed upstream and you don't want to pick it up, configure Archiva to fail on checksum mismatch [1]. - or as an alternative to enforcing the checksum, configure your local repo as internal instead of proxied, and handle it all yourself [2]. [1] https://archiva.apache.org/docs/2.2.1/adminguide/proxy-connectors.html https://archiva.apache.org/docs/2.2.1/adminguide/proxy-conne... [2] https://archiva.apache.org/docs/2.2.1/adminguide/repositories.html https://archiva.apache.org/docs/2.2.1/adminguide/repositorie...
- qw 10y agoIf Nexus doesn't have that functionality, you can probably put an Nginx reverse proxy behind it that will always serve local files if available.
- pcl 10y agoWe maintain and check SHAs of the dependencies for that reason.