CODEWITHSUNDEEP
mavengradlenexussonatype
Andrew Carre
Andrew Carre

Reputation: 61

Preemptively downloading artifacts to Sonatype Nexus for offline use

I am working in a security sensitive setting where I have to airgap my computer during development and would go online as a last resort. I know this isn't ideal.

I setup a sonatype repository on my computer locally but it only caches the artifacts as I download them and I don't know all the artifacts I need right now so I need to cache everything.

Is there a way to download all the artifacts from maven central, Pypi, nuget etc? Are there any prepackage blobs out there?

Upvotes: 1

Views: 833

Answers (2)

madhead
madhead

Reputation: 33392

Here is what the official documentation says:

Creating Your Own Mirror The size of the central repository is increasing steadily. To save us bandwidth and you time, mirroring the entire central repository is not allowed. (Doing so will get you automatically banned). Instead, we suggest you setup a repository manager as a proxy.

If you really want to become an official mirror, contact us at MVNCENTRAL with your location and we'll work to get you setup.

So, what you've done — local proxy — is a good solution.

Now I want to ask you a question: without the Internet connection, how do you know what library do you need? I mean you need to know Maven coordinates of a library in order to download it, but without the network is not possible unless you're a telepath.

Then you're saying that you're working in a security sensitive environment, but then you're also saying that you want to download all the Central and be able to use any library. That is not how security works. When one is really concerned about the security he audits the code and uses verified artifacts only. Anybody with a PGP key can put anything in the Central.

One more thing: hosting a local proxying repository is a little bit nonsense, because Maven itself caches all the needed artifacts in ~/.m2/. So now you have two copies of the same artifacts: one copy in local Nexus and another in your home directory. BTW, you can download everything that you need for a current project in advance with mvn dependency:go-offline.

Upvotes: 1

J Fabian Meier
J Fabian Meier

Reputation: 35795

It is not possible. MavenCentral is huge, probably dozens of TB or even more.

You need to cache the artifacts you need for your build. If you need more, you need to connect to the Internet again.

Upvotes: 2

Related Questions