Resolve dependencies

A repository is a dependency source for Maven and Gradle. Point your build at its Maven URL and resolve as you would from any other repository.

Add the repository to Maven

In pom.xml:

<repositories>
  <repository>
    <id>codesoh</id>
    <url>https://artifex.soh.gg/maven/OWNER/SLUG/</url>
    <releases><enabled>true</enabled></releases>
    <snapshots><enabled>true</enabled></snapshots>
  </repository>
</repositories>

For a repository that holds Maven plugins, add the same entry under pluginRepositories.

Add the repository to Gradle

In settings.gradle.kts:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = "codesoh"
            url = uri("https://artifex.soh.gg/maven/OWNER/SLUG/")
        }
    }
}

In settings.gradle:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = 'codesoh'
            url = 'https://artifex.soh.gg/maven/OWNER/SLUG/'
        }
    }
}

Resolve from a private repository

A private repository needs a personal access token with at least read permission in that repository. A public repository needs no credentials.

Maven reads the credentials from ~/.m2/settings.xml, matched by the repository's id:

<settings>
  <servers>
    <server>
      <id>codesoh</id>
      <username>YOUR_HANDLE</username>
      <password>cs_pat_YOUR_TOKEN</password>
    </server>
  </servers>
</settings>

Gradle reads them from ~/.gradle/gradle.properties, matched by the repository's name:

codesohUsername=YOUR_HANDLE
codesohPassword=cs_pat_YOUR_TOKEN

maven {
    name = "codesoh"
    url = uri("https://artifex.soh.gg/maven/OWNER/SLUG/")
    credentials(PasswordCredentials::class)
}

Keep tokens out of your repository. Put them in your home directory, or in the secret store of your CI system, and read them from there.

Artifex accepts the token as the password of HTTP Basic authentication, which is what Maven and Gradle send, and also as a bearer token if you're writing your own client.

What a build can ask for

A build resolves files by their Maven path. Artifex serves the following:

• Files that were deployed to the repository.
• Files that an upstream supplies, cached on first use.
• A maven-metadata.xml at the group, artifact, and version level, generated from what the repository holds and merged with what its upstreams report.
• A checksum of any of those, at .md5, .sha1, .sha256, or .sha512.

Directory listings aren't available. A request for a directory answers 404 Not Found with the message Directory listings aren't available. Request a file. Use the repository pages or search to look around.

Caching

A release file is served with a long cache lifetime and marked immutable, because it can't change. Metadata and checksums are served with no-cache, so a client revalidates them.

Artifex answers conditional requests with 304 Not Modified and range requests with 206 Partial Content, which is what resumable downloads need.

One repository for everything

Rather than listing many repositories in every build, give one Artifex repository the upstreams that it should reach, and point your builds at it alone. For more information, see Upstream repositories.