在Maven中使用封闭源代码依赖项 [英] Using closed-source dependencies with Maven

问题描述

我有一个我想使用Maven构建的开源项目.它依赖于两个Java库，这些库在我可以找到的任何公共存储库中都不可用(在这种情况下为libGoogleAnalytics.jar和FlurryAgent.jar，但问题适用于任何封闭源代码依赖项).

我希望组织中的任何人都能够使用与构建应用程序完全相同的依赖关系版本来构建应用程序.这包括我的同事和我们的构建服务器.

如何管理Maven不知道如何解决的封闭源依赖关系?

很明显，我可以去每个人的机器上并手动执行"mvn install:install-file"，将二进制文件放入他们的maven存储库中，但是像这样手动管理依赖项会破坏依赖管理器的目的.

根据maven的内部存储库文档，我可以设置将存储库服务器放在某个位置，然后将二进制文件放到那里，所有开发人员都可以访问它们.但这意味着我需要维护一个新服务器(或至少在现有服务器上有一个新网站).这也意味着我必须担心权限问题，以确保外部各方无法访问存储库.这也意味着我现在必须担心备份和可用性，以便在存储库不可用时，开发人员不会遇到麻烦.

如果我可以以某种方式使用现有的scm(在这种情况下为hg，但是可以是git或svn或其他任何东西)来存储依赖项，那么所有这些问题对我来说都会消失.我们的源代码控制存储库已经备份，基本上可以由进行构建的开发人员使用，并且其权限已得到处理.

但是，即使有可能，我仍无法弄清楚如何使用hg管理Maven依赖项.

解决方案

事实证明，曼弗雷德(Manfred)的回答对我而言并不奏效.该应用已编译，但由于缺少必需的Google Analytics(分析)类而无法在我的Android设备上运行.

在他提供的链接之后，我发现了

As per maven's Internal Repositories documentation, I could set up a repository server somewhere and put the binaries there, which all the developers would then access. But that means I have a new server to maintain (or at least a new website on an existing server). It also means I have to worry about permissions to ensure that outside parties can't access the repository. It also means I have to worry about backups and availability now so that developers don't run into hiccoughs if the repository is unavailable.

All of these problems would go away for me if I could somehow use our existing scm (hg in this case, but it could be git or svn or whatever) to store the dependencies. Our source control repository is backed up already, it will basically always be available to developers doing builds, and its permissions have already been dealt with.

But I haven't been able to figure out how to manage maven dependencies using hg yet, if this is even possible.

解决方案

It turns out that Manfred's answer didn't quite work for me. The app compiled, but it did not run on my Android device because the required google analytics classes were missing.

Following the links he supplied, I discovered this solution which is actually a little cleaner and worked properly.

In summary, I added the following dependencies to my pom.xml. The groupId, artifactId, and version were all made up by me using reasonable values:

<dependencies>
    ...
    <dependency>
        <groupId>com.google.android.apps.analytics</groupId>
        <artifactId>libGoogleAnalytics</artifactId>
        <version>1.1</version>
    </dependency>
    <dependency>
        <groupId>com.flurry</groupId>
        <artifactId>FlurryAgent</artifactId>
        <version>1.24</version>
    </dependency>
</dependencies>

I then added a repository definition for where I'm storing the third party dependencies in my project's source tree:

    <repository>
        <id>third.party.closed.source.repo</id>
        <url>file://${basedir}/../maven_repo_3rd_party</url>
    </repository>

I then moved the jar files to the following location:

./maven_repo_3rd_party/com/google/android/apps/analytics/libGoogleAnalytics/1.1/libGoogleAnalytics-1.1.jar
./maven_repo_3rd_party/com/flurry/FlurryAgent/1.24/FlurryAgent-1.24.jar

Once I did that, my project compiled and ran exactly as if the third party dependencies were resolved from an official maven repo.

这篇关于在Maven中使用封闭源代码依赖项的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！