Nexus 中的发布存储库策略是否确保 jar 永远不会改变？
我正在部署 Nexus OSS 作为内部公司存储库。 主要要求之一是，一旦 Nexus 下载了 jar（例如，当使用 is 作为 Maven Central 的代理时），它就永远不会改变。 我知道 Maven Central 有该政策，但我正在使用不受我控制的其他存储库，并且我必须在我这边验证该要求。
发布存储库策略是否确保一旦将 jar 下载到该存储库中，它就永远不会改变？
该要求的存在是为了确保我们可以返回到 1.5 年前创建的产品版本，并确保产品使用的存储库工件与现在构建产品时相同。
I'm in the process of deploying Nexus OSS as internal company repository.
One of the main requirements is that once a jar has been downloaded by Nexus (for example, when using is as a proxy of Maven Central) it will never change.
I know that Maven Central has that policy, but I'm using other repositories which are not under my control, and I have to validate that requirement on my side.
Does a Release repository policy ensures that once a jar is downloaded into that respository, it will never change?
The requirement exists to ensure we can go back to a version of our product created 1.5 years ago, and make sure the repository artifacts used by the product are the same when building it now.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
事实上，发布存储库应该严格禁止发布后的内容修改，这就是 Maven Central 正在做的事情：
话虽如此，Maven 客户端是否会（重新）下载工件并不真正取决于存储库及其策略，这是 Maven DNA 的一部分，并且它不会发生（除非您从您的应用程序中删除给定的工件）当然是本地存储库）。在 [MNG-2528] 中引用 Brett Porter - updatePolicy“always”不适用于具有“releases”的存储库“，至少对于传递依赖来说不是：
换句话说，如果您不删除 Nexus 存储库的内容，Nexus 将永远不会再次重新下载已发布的工件，因此您将能够使用完全相同的库重建两年前创建的产品版本。
Indeed, a release repository should strictly forbid content modification after a release, which is what Maven Central is doing:
That being said, whether a Maven client will (re)download an artifact or not does not really depend on the repository and its policy, this is part of Maven DNA and it just won't happen (unless you delete the given artifact from your local repository of course). Quoting Brett Porter in [MNG-2528] - updatePolicy "always" does not work for repositories with "releases", at least not for transitive dependencies:
In other words, if you don't delete the content of your Nexus repository, Nexus will never re-download a released artifact again and you will thus be able to rebuild the version of your product created two years ago, using the exact same libraries.