Recommend Build Artifact Repository Manager [closed]

Question

Currently we use FTP to maintain build artifact distribution and 3rd party products (for internal use only).

Artifacts are docs (HTML/pdf/chm/...), libs (.dll/.so/.a/.jar/...), programs (.exe/.jar/...) and anything else. They are not restricted to Java/.NET and can come from different cultures (firmware, driver, mobile/workstation, GUI, Win/Linux/Mac/Solaris/AIX,... etc).

To orginize hierarhy we use such paths:

ftp://3pp/VENDOR/PRODUCT/VERSION/...
ftp://3pp/opensource/PACKAGE-x.x.x.tar.bz2
ftp://dist/PRODUCT/VERSION/...

To maintain description of artifacts we use README and CHANGES plain test files (reStructuredText).

What is missing in this schema?

• Missing permissions (anyone can damage storage).
• Missing dependency tracking (so every build file must be updated if version dependency changed).
• Missing fetching activity (some files seem no longer needed, but we don't know which).

I am not deeply looking for existing solutions. Some package manager like rpm/dpkg, heard about Maven repo etc...

Please recommend Build Artifact Repository Managers. Also it is good to hear drawbacks and restrictions.

UPDATE

• https://en.wikipedia.org/wiki/Binary_repository_manager
• https://binary-repositories-comparison.github.io/

Blasphemy

Answer 1

You're creating a custom software artifact repository. There are three open-source projects which already do this:

• Artifactory
• Nexus
• Archiva

Artifactory and Nexus also have paid versions.

You can store any kind of file in these repositories, and you don't need to use Maven. You can manually deploy artifacts to them. You can set up fine-grained access control. They integrate well with automated build tools.

I think using one of these tools would save you a lot of effort!

Here's fairly unbiased (community-driven) comparison matrix between the three.

Strangles

Absolutely not true. You can store any type software artifact in these repositories. Java may have the most mature tools, but there are no restrictions that prevent you from using these repositories with other technologies. Take a look at Sonatype's book on repository management to get an understanding of how artifact repositories work and how you might be able to integrate them into your workflow. sonatype.com/books/nexus-book – Strangles

Is there an opensource equivalent of Bintray? – Teddie

binary-repositories-comparison.github.io – Blasphemy

Link to "binary-repositories-comparison.github.io" leads to a broken page. – Dubuffet

Answer 2

With SVN + Apache (mod_dav_svn.so, mod_authz_svn.so) seems I get:

• Anonymous read only access through HTTP protocol with wide range of supported clients for downloading (wget/curl from GNU Make, task for Apache Ant).

• Easy maintainable write access for users/groups (easy syntax):

  [repo:/path]
  user = rw
  

  through cadaver utility.

• Integration with LDAP.

• History of releases (when, what and who).
• Atomic operation (prevent from concurrent releases and rollback on errors).

Blasphemy