Max Age Question

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

Max Age Question

Sony Antony
Hello :
http://books.sonatype.com/nexus-book/reference/confignx-sect-manage-repo.html

1. It says 'Artifact Max Age' is -1 by default. Does -1  mean 'never'.  ?
2. But then 'Metadata Max Age' will expire in 24 hours. So why fetch
metadata if nexus will never fetch teh artifact ?

3. Why is teh default 'Checksum Policy' 'warn' . Because you can get a
corrupt file and never know about it. ( Yes there will ne warning in
teh log. But maven repository users will never know that there was a
warning in the repository manager against teh file )


--sony

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: Max Age Question

Rich Seddon
1. It says 'Artifact Max Age' is -1 by default. Does -1  mean 'never'.  ?
Yes, this means never.  In Maven when a specific group ID, artifact ID, and version of an artifact is released it is generally considered immutable.  Nexus therefore assumes if it has a specific version of a release artifact cached it does not need to check for new versions of it.

It does not prevent download of new artifacts.


2. But then 'Metadata Max Age' will expire in 24 hours. So why fetch
metadata if nexus will never fetch teh artifact ?

This timeout refers to the period to wait before checking for updates to maven-metadata.xml files.  These files indicate which versions are available (among other things).  They need to be periodically refreshed to account for deployment of new versions on the remote.

3. Why is teh default 'Checksum Policy' 'warn' . Because you can get a
corrupt file and never know about it. ( Yes there will ne warning in
teh log. But maven repository users will never know that there was a
warning in the repository manager against teh file )


Unfortunately we've found that historically many public proxy repositories do not publish checksum files, or have invalid checksum files.

The situation has been improving in recent years, you can probably set this to "strict" for Maven Central now, and "strict if exists" for other proxy repositories.

Rich


On Thu, Jun 5, 2014 at 10:38 AM, Sony Antony <[hidden email]> wrote:
Hello :
http://books.sonatype.com/nexus-book/reference/confignx-sect-manage-repo.html

1. It says 'Artifact Max Age' is -1 by default. Does -1  mean 'never'.  ?
2. But then 'Metadata Max Age' will expire in 24 hours. So why fetch
metadata if nexus will never fetch teh artifact ?

3. Why is teh default 'Checksum Policy' 'warn' . Because you can get a
corrupt file and never know about it. ( Yes there will ne warning in
teh log. But maven repository users will never know that there was a
warning in the repository manager against teh file )


--sony

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]


Reply | Threaded
Open this post in threaded view
|

Re: Max Age Question

MarkMiller
Morning Rich,

I'm looking for content for the new community site that will open in July. Do you have any Q&A  type emails I  can use to get the ball rolling?

Mark


On Thu, Jun 5, 2014 at 6:08 PM, Rich Seddon <[hidden email]> wrote:
1. It says 'Artifact Max Age' is -1 by default. Does -1  mean 'never'.  ?
Yes, this means never.  In Maven when a specific group ID, artifact ID, and version of an artifact is released it is generally considered immutable.  Nexus therefore assumes if it has a specific version of a release artifact cached it does not need to check for new versions of it.

It does not prevent download of new artifacts.


2. But then 'Metadata Max Age' will expire in 24 hours. So why fetch
metadata if nexus will never fetch teh artifact ?

This timeout refers to the period to wait before checking for updates to maven-metadata.xml files.  These files indicate which versions are available (among other things).  They need to be periodically refreshed to account for deployment of new versions on the remote.

3. Why is teh default 'Checksum Policy' 'warn' . Because you can get a
corrupt file and never know about it. ( Yes there will ne warning in
teh log. But maven repository users will never know that there was a
warning in the repository manager against teh file )


Unfortunately we've found that historically many public proxy repositories do not publish checksum files, or have invalid checksum files.

The situation has been improving in recent years, you can probably set this to "strict" for Maven Central now, and "strict if exists" for other proxy repositories.

Rich


On Thu, Jun 5, 2014 at 10:38 AM, Sony Antony <[hidden email]> wrote:
Hello :
http://books.sonatype.com/nexus-book/reference/confignx-sect-manage-repo.html

1. It says 'Artifact Max Age' is -1 by default. Does -1  mean 'never'.  ?
2. But then 'Metadata Max Age' will expire in 24 hours. So why fetch
metadata if nexus will never fetch teh artifact ?

3. Why is teh default 'Checksum Policy' 'warn' . Because you can get a
corrupt file and never know about it. ( Yes there will ne warning in
teh log. But maven repository users will never know that there was a
warning in the repository manager against teh file )


--sony

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]





--


Mark Miller, Community Advocate
Nexus Pro Community Advocate, Sonatype
Curator and Founder, Trusted Software Alliance
Host and Executive Producer, OWASP 24/7 Podcast Channel