The Benefits of Utilizing a Repository Manager

Transcription

1 Sonatype Nexus TM Professional Whitepaper The Benefits of Utilizing a Repository Manager An Introduction to Sonatype Nexus TM Professional SONATYPE sales@sonatype.com Prosperity Drive, Suite 350, Silver Spring, MD, Copyright 2011, Sonatype Inc. All rights reserved. Sonatype and Sonatype Insight are trademarks of All other trademarks are the property of their respective owners.

2 OVERVIEW For software development organizations doing component-based software development, utilizing a repository manager offers a host of benefits, including: Faster, more reliable builds. Hosting components locally saves time and improves reliability as it eliminates the need to download components and their dependencies from the remote servers or over the Internet. Improved collaboration. Developers and partners can easily store, find and securely share binary components and existing code through the repository manager. Enhanced visibility. Components and their dependencies are stored in one place, providing insight into which components have been used in applications. Better control. Problematic components can be removed from a central location. Component acquisition flows only through the guidelines set in the repository, so white and black lists can be managed easily. Improved Decision-Making. Utilizing real-time feeds for component security, licensing, and popularity, developers and technical leaders can make better decisions about the artifacts they use and stay informed when there are critical updates. Streamlined development and deployments. Staging binary components on the repository manager makes it easier to manage multi-module projects and provides a clear separation between multiple work groups, so you can more efficiently test and deploy applications. Simplify commercial component updates. Accessing commercial components through a vendor s repository makes it much easier to receive, install, and start using updated code. Due to these benefits, repository managers are essential infrastructure for component-based software development. Nexus Professional delivers superior control and support with the industry s most widely used repository manager. Read on to learn how. FASTER AND MORE RELIABLE BUILDS Developers who use Apache Maven, or any of a variety tools that can download artifacts from the Central Repository, have probably had the experience of checking out a large build from source control, running it, then waiting while the build downloads dependencies. They also may have experienced failed builds resulting from unavailable remote servers or Internet connections. Repository managers like Nexus Pro store components locally. So downloading dependencies takes far less time as builds don t rely on Internet access. Unless this is the first time building a particular project, all of the build components will be cached at the repository manager. By avoiding the Internet and remote servers, the build process is faster 4. Retrieve remote components on first request 3. Provide components to the build system 2. Request components 1. List of dependent components Figure 1. Repository managers store components locally, saving time and increasing build reliability. 2

3 and more reliable. A build that once took 15 minutes to download dependencies takes only seconds to download everything it needs from the local repository. IMPROVE COLLABORATION To illustrate how repository managers improve collaboration, imagine three large development groups: Group 1: An ecommerce group writing systems that interact with banks and service providers like PayPal. Group 2: A customer relationship management (CRM) group merging two disparate CRM solutions. Group 3: A web applications group wrapping the two back-office systems in a web interface. Group 1 and 2 expose their services through APIs (ecommerce-api and CRM-API), which contain the logic required to connect to a set of internal services hosted by each group. As each group innovates and offers new services, they release components to implement new APIs, and publish the releases to the repository manager. (See Figure 2) When Group 3 needs a new version of the ecommerce or CRM -API, they can update their project Figure 2. The repository manager is the central point of collaboration between development groups. to depend on a new version of the API-enabling component and download it directly from the corporate repository manager. In this way, the repository manager becomes the central collaboration point for different groups within the same company. Without a repository manager, disparate groups are forced to check each other s code out of SCM and build it from scratch to generate client libraries. Organizations that have embraced repository management have these libraries published as binaries for clients to consume. Using a repository manager allows different workgroups to innovate and create at their own pace. And multiple workgroups can collaborate much more effectively. The security features of a modern repository manager, such as Nexus Pro, also make it an excellent platform for sharing components with partners and select outside parties. Organizations can create partner-specific libraries and limit access to just intended recipients. Specific repositories provide the necessary access controls for maintaining the security of projects and segment work from each partner or outsourced supplier. 3

4 ENHANCE VISIBILITY AND CONTROL All organizations need to know: components are being used in applications; free of security issues and; open source licenses. This is particularly important when new defects are reported and components need to be updated to resolve security or quality issues. Figure 3. Nexus Pro provides detailed security and license information for every component in the repository. By acting as the primary source for all components, a repository manager, such as Nexus Pro, eliminates this problem. It provides visibility into which components have been downloaded from public repositories, along with detailed security and licensing information for every component in the repository. The procurement features of Nexus Pro also give architects and management control over which components are allowed into the organization or build. A Nexus administrator or procurement manager can allow or deny specific artifacts by group, version, or path. The procurement manager can also be used as a firewall between an organization s development environment and the tens of thousands of components available from the Central Repository. STREAMLINE DEVELOPMENT Figure 4. Nexus Pro enforces standards by restricting which components can be downloaded from the Internet. As software projects evolve, they often become so large and unwieldy that even the simplest changes become difficult. One minor change can affect some far-flung bit of code, and developers are forced to compile and test the entire project with each change. With Nexus Pro, however, a developer can work on specific components of a larger multi-module project. This ability to divide and conquer the codebase comes in handy when: By continuously publishing build artifacts to a repository manager, development can move away from the single monolithic project build and toward an easy-to-follow project layout and architecture. 4

5 Here s an example of a hypothetical project and dependency graph: ecom-paypal ecom-api ecom-audit ecom-compliance ecom-storage ecom-mysql ecom-util ecom-cassandra Without a repository manager, trying to build a new version of ecom-paypal in isolation may generate errors because developers are forced to check out the entire codebase to build and install all of the dependencies. Using a repository manager and a continuous integration (CI) server, the CI server can be configured to publish SNAPSHOT artifacts (in-progress SNAPSHOT binaries) to the repository manager. This allows developers to examine a single isolated portion of the project at a time. Now, when you run the ecom-paypal module s build in isolation, your build manager will just download and use the most recent SNAPSHOT of the other modules. SPEED THE DEPLOYMENT PROCESS Moving a project from development through QA to production requires tremendous coordination between groups. Any time new code is moved into production, getting everyone in sync is challenging. If your production deployment depends directly on your build, you have to recompile and repackage your entire system every time you do a deployment. This is often a challenge because the people that run the build system for deployment are seldom the same engineers that develop your system. When an operations team has to check out source code from an SCM just to build a production application, they introduce risk into the build process. With Nexus Pro, you can publish a release candidate binary to a hosted repository. Then you can use a deployment script (or a tool like ControlTier or Puppet) to publish the candidate binaries to a QA environment, and have a deployment script that takes the same, certified binary and publishes it to production. Figure 5. Nexus Pro supports temporary staging repositories and manages the promotion of components between stages to improve the deployment process. 5

6 The staging feature in Nexus Pro automates the repository-based approach: release repository. The development processes is improved with a controlled workflow that ensures components meet set requirements before being promoted through QA to production. UPDATE COMMERCIAL COMPONENTS WITH EASE While the Central Repository houses the vast majority of open source components, it does not contain proprietary artifacts. These components must be downloaded and installed separately. If a build depends on a proprietary component, such as the Oracle JDBC driver, it must be downloaded and installed separately. When vendors embrace repository management, there s no need for organizations to manually install any third-party JARs in the corporate repository. Instead, they will provide binaries to customers via authenticated public repositories. These vendor-run repositories, protected by authentication credentials, can be proxied by a corporate repository manager, which will automatically retrieve new components as they are referenced in your code. Both the customer and the vendor have fewer moving parts to worry about, and the task of delivering software becomes very simple. CONCLUSION Repository managers, such as Sonatype Nexus and Nexus Professional are critical to the success of modern, component based software development. Nearly 20,000 organizations rely on Nexus to speed build times and improve visibility and control over the components they use in software development. Key benefits include: Nexus Professional adds key features such as high availability, support for.net components, and real-time information about component security, licensing, and popularity. More information about Sonatype Nexus Professional can be found at 6