如何管理 git 中 maven 存储库的弃用？

Question

My company has many Java projects that use maven as its primary dependency management tool. We write a number of our own dependencies (common functionality libraries relevant to my company's needs) which then need to be hosted in a maven repository so that our applications can download them as a dependency. Our own dependencies, however, are not exposed to the world; we want to be the only ones who have access to these artifacts and so we host our artifacts in private repos.

For example, our POMs typically have the following repository block:

<repository>
    <id>artifactory</id>
    <!-- Note: not a real maven repo... :P -->
    <url>http://initech.artifactoryonline.com/initech/repo/</url>
    <snapshots>
        <updatePolicy>always</updatePolicy>
    </snapshots>
</repository>

So, ArtifactoryOnline.com hosts all of our private dependencies today. Oh, and we use git as our vcs, so this repository block is in the pom.xml from the beginning of time.

Here's the problem: ArtifactoryOnline.com is going away in a few months time (replaced with JFrog.io) and there is nothing that my company can do to influence that decision. The owners of ArtifactoryOnline.com have issued a statement saying that attempts to fetch resources from their deprecated host will fail once that time comes.

This is a problem for us. We have tens of thousands of commits across a dozen projects that depend upon this deprecated repository. These commits have been through a rigorous QA process and represent over a decade of hard work on behalf of my company. Yet, once this change occurs and the deprecated host goes offline, all of those builds which at one point worked are going to suddenly break due to missing dependency links. Anyone who wants to use an old build of our application code will need to create a new branch and re-write the repository tag! This is a big problem for us. (Lord have mercy if you need to bisect to isolate an old bug.)

How can/should we handle this? Is there a way to retroactively modify the pom deep in the past of our projects such that the replacement repository is visible to the full time-line of our git repos?

Answer 1

You can always add a mirror to the repository. The way it was handled here . You can either add it to each pom.xml or add it to settings.xml . The default location of the latter is ~/.m2/settings.xml .