You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by AnasMughal <an...@gmail.com> on 2011/04/07 02:04:18 UTC
Checkout and Build all dependencies
We have a compliance/audit requirement that we need to be able to exactly
reproduce builds. (Current requirement does not allow the build machine
access to our internal nexus repository.)
We have a few projects with typical maven dependency hierarchy. Is there a
way that I could setup a build script that would fetch all dependencies from
SVN and then trigger a complete build.
Of course, we start the build process by deleting everything from the local
maven repository.
Then, we build going down the dependency hierarchy. As we build a parent, we
install it in the local maven repository on the build machine.
This does seem to be something that CruiseControl and Hudson do. Should I
consider just setting up CruiseControl or Hudson to perform the builds for
us? Or, is there a better way to setup this checkout and build process.
Any advice much appreciated.
--
Anas Mughal
--
View this message in context: http://maven.40175.n5.nabble.com/Checkout-and-Build-all-dependencies-tp4287477p4287477.html
Sent from the Maven - Users mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Checkout and Build all dependencies
Posted by Ron Wheeler <rw...@artifact-software.com>.
On 06/04/2011 8:04 PM, AnasMughal wrote:
> We have a compliance/audit requirement that we need to be able to exactly
> reproduce builds. (Current requirement does not allow the build machine
> access to our internal nexus repository.)
All builds or just releases?
What stops you from doing that now? If you use releases properly in
Maven and in your SVN, you should be able to rebuild any release.
Everyone that has a system in production that is maintained has this
need. It is not just an idea imposed from outside.
If you can not rebuild every module that you have released into
production or out to a customer base, how do you know that you can fix
any bugs?
SVN has all the information required to find the source code and the
Maven POMs have all the information required to rebuild any release from
the sources with all of the correct third party software and correct
internally generated artifacts.
Building a snapshot takes more effort.
How often do you need to demonstrate a complete rebuild?
Is it worth automating?
How many projects make up the complete application?
Ours has over 70 and I am sure that I can rebuild all 70 for any release
but I have never thought of automating the process.
It would take a couple of hours to rebuild and I would have to set up a
new Nexus if I did not want to delete the existing releases from Nexus.
I do not backup my Nexus data so I have to be sure that I can rebuild
any release artifact from the sources.
I know that I can build something close to the snapshots that existed on
any given day using the history in SVN to identify the right sources.
It will be more work and some modules may be out of synch if the
developer did not check in every source that was deployed as a SNAPSHOT.
We do not require that in our workflow nor do I particularly care about
rebuilding SNAPSHOTS as they are transient by definition and are never
released into the wild.
Ron
> We have a few projects with typical maven dependency hierarchy. Is there a
> way that I could setup a build script that would fetch all dependencies from
> SVN and then trigger a complete build.
>
> Of course, we start the build process by deleting everything from the local
> maven repository.
>
> Then, we build going down the dependency hierarchy. As we build a parent, we
> install it in the local maven repository on the build machine.
>
> This does seem to be something that CruiseControl and Hudson do. Should I
> consider just setting up CruiseControl or Hudson to perform the builds for
> us? Or, is there a better way to setup this checkout and build process.
>
> Any advice much appreciated.
> --
> Anas Mughal
>
> --
> View this message in context: http://maven.40175.n5.nabble.com/Checkout-and-Build-all-dependencies-tp4287477p4287477.html
> Sent from the Maven - Users mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Checkout and Build all dependencies
Posted by Ron Wheeler <rw...@artifact-software.com>.
On 07/04/2011 4:49 PM, AnasMughal wrote:
> Yes, that is very similar to our requirement: We need to lock down the build
> environment to be able to reproduce the build at anytime in the future.
>
Need to use version numbers to control your plug-ins as well as your own
stuff.
Need to use SVN to tag and branch your projects.
> Here are the high level objectives:
>
> Checkout all projects from SVN
> Build projects using Maven and install them to the local Maven repository.
> We would need to start with the parent projects.
>
Sounds like a simple batch job will do this.
Not hard to make a template where you can search and replace on the
version of the project or plug-ins that you want.
You should probably build this in advance of each release so that, at
the start of the development, you nail down the "official" versions of
plug-ins that your developers use to build.
This should be in your SVN and properly tagged and branched.
> Totally agree: we will not check in everything in SVN.
>
Can't check-out what you don't check-in.
Ron
>
>
>
> On Thu, Apr 7, 2011 at 8:34 AM, Manfred Moser [via Maven]<
> ml-node+4288827-1669842602-196487@n5.nabble.com> wrote:
>
>> > We have a compliance/audit requirement that we need to be able to
>> exactly
>>> reproduce builds. (Current requirement does not allow the build machine
>>> access to our internal nexus repository.)
>> I have had to deal with this sort of requirement in the past in ISO, FDA
>> and code repository context. In my opinion you need to be able to build
>> "without anything else apart from the supplied codebase/artifacts". In the
>> Maven world the best way to achieve this is to package up all the source
>> code and your repository server setup (or at least the repository used by
>> your build with all artifacts as well as Maven in the exact version you
>> use.
>>
>> You will have to lock down all plugin and dependency versions and be sure
>> to have them in the repo and then you will be able to do a complete
>> offline build with the repo.
>>
>> If you dont do that you will have some major nightmares in terms of
>> reproducibility of the build and the used artifacts. Do NOT follow down
>> the path of "just" trying to check everything into svn. If you do that you
>> properly you will end up with the repository server in svn. Might as well
>> allow the repo server to be an artifact...
>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [hidden email]<http://user/SendEmail.jtp?type=node&node=4288827&i=0&by-user=t>
>> For additional commands, e-mail: [hidden email]<http://user/SendEmail.jtp?type=node&node=4288827&i=1&by-user=t>
>>
>>
>>
>> ------------------------------
>> If you reply to this email, your message will be added to the discussion
>> below:
>>
>> http://maven.40175.n5.nabble.com/Checkout-and-Build-all-dependencies-tp4287477p4288827.html
>> To unsubscribe from Checkout and Build all dependencies, click here<http://maven.40175.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=4287477&code=YW5hc211Z2hhbEBnbWFpbC5jb218NDI4NzQ3N3wtMzc0Njc1OTEy>.
>>
>>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Checkout and Build all dependencies
Posted by AnasMughal <an...@gmail.com>.
Yes, that is very similar to our requirement: We need to lock down the build
environment to be able to reproduce the build at anytime in the future.
Here are the high level objectives:
Checkout all projects from SVN
Build projects using Maven and install them to the local Maven repository.
We would need to start with the parent projects.
Totally agree: we will not check in everything in SVN.
On Thu, Apr 7, 2011 at 8:34 AM, Manfred Moser [via Maven] <
ml-node+4288827-1669842602-196487@n5.nabble.com> wrote:
> > We have a compliance/audit requirement that we need to be able to
> exactly
> > reproduce builds. (Current requirement does not allow the build machine
> > access to our internal nexus repository.)
>
> I have had to deal with this sort of requirement in the past in ISO, FDA
> and code repository context. In my opinion you need to be able to build
> "without anything else apart from the supplied codebase/artifacts". In the
> Maven world the best way to achieve this is to package up all the source
> code and your repository server setup (or at least the repository used by
> your build with all artifacts as well as Maven in the exact version you
> use.
>
> You will have to lock down all plugin and dependency versions and be sure
> to have them in the repo and then you will be able to do a complete
> offline build with the repo.
>
> If you dont do that you will have some major nightmares in terms of
> reproducibility of the build and the used artifacts. Do NOT follow down
> the path of "just" trying to check everything into svn. If you do that you
> properly you will end up with the repository server in svn. Might as well
> allow the repo server to be an artifact...
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]<http://user/SendEmail.jtp?type=node&node=4288827&i=0&by-user=t>
> For additional commands, e-mail: [hidden email]<http://user/SendEmail.jtp?type=node&node=4288827&i=1&by-user=t>
>
>
>
> ------------------------------
> If you reply to this email, your message will be added to the discussion
> below:
>
> http://maven.40175.n5.nabble.com/Checkout-and-Build-all-dependencies-tp4287477p4288827.html
> To unsubscribe from Checkout and Build all dependencies, click here<http://maven.40175.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=4287477&code=YW5hc211Z2hhbEBnbWFpbC5jb218NDI4NzQ3N3wtMzc0Njc1OTEy>.
>
>
--
Anas Mughal
--
View this message in context: http://maven.40175.n5.nabble.com/Checkout-and-Build-all-dependencies-tp4287477p4289419.html
Sent from the Maven - Users mailing list archive at Nabble.com.
Re: Checkout and Build all dependencies
Posted by Manfred Moser <ma...@mosabuam.com>.
> We have a compliance/audit requirement that we need to be able to exactly
> reproduce builds. (Current requirement does not allow the build machine
> access to our internal nexus repository.)
I have had to deal with this sort of requirement in the past in ISO, FDA
and code repository context. In my opinion you need to be able to build
"without anything else apart from the supplied codebase/artifacts". In the
Maven world the best way to achieve this is to package up all the source
code and your repository server setup (or at least the repository used by
your build with all artifacts as well as Maven in the exact version you
use.
You will have to lock down all plugin and dependency versions and be sure
to have them in the repo and then you will be able to do a complete
offline build with the repo.
If you dont do that you will have some major nightmares in terms of
reproducibility of the build and the used artifacts. Do NOT follow down
the path of "just" trying to check everything into svn. If you do that you
properly you will end up with the repository server in svn. Might as well
allow the repo server to be an artifact...
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org