Distribution enterprise for java artifacts?

Question

I was wondering if there is a distribution management entity for java based artifacts, very similar to the way RHEL (or the like) distributes the linux based artifacts. Some of the features that were of interest were:

• Source code for the artifacts (should the open source project hosting website goes away)
• Security updates related alerts (like if the previous distribution version used a version of struts that is known to have security vulnerabilities, we should get a notice of it proactively)
• Secure SSL connections (I know jcenter bintray provides this rather than the non-SSL to maven central)
• Licensing related meta-data (because not all maven artifacts use the license-maven-plugin)
• Possible whitelisting of artifacts that are approved for use

I am not very sure myself if this can be achieved outside of a repo manager itself, and was hoping that someone might point out the similiarities between this and RHEL for the OS related modules that have similar security updates related alerts. I might be completely off, and would appreciate if someone can point out how these concerns are addressed in the java world.

Thanks in advance!

Answer 1

I would recommend using Bintray.

Bintray is a cloud platform that gives you full control over how you publish, store, promote, and distribute software.

As the most advanced platform for distributing software, Bintray offers:

• Private repositories with fine-grained access control.
• 100% automation.
• Stats and logs.
• Download speed and reliability.

You can read more details about Bintray features.

For security alerts you should use the JFrog-Artifactory and configure it with the JFrog-Xray. The Xray product allows to add watchers and sign webhooks specific to the configuration you define. You can start your free trial.

Good luck.

^{I am with JFrog, the company behind bintray and artifactory and xray, see my profile for details and links.}