Enable configuring a mirror of maven central

[ajdergute]

Describe the Enhancement

As a user of this buildpack I want to use a local mirror as drop in replacement for e.g. maven central. We use Artifactory for this.

Possible Solution

To do so it would be very smooth to configure an alternative mirror via environment variables.

https://github.com/paketo-buildpacks/maven/blob/main/buildpack.toml#L76 With this variable a user is able to replace https://repo1.maven.org/maven/ with something else.

Motivation

In our company we try to reduce remote traffic, which could be slow at times. Also we try to avoid that someone replaces a file and build results are changing unpredictable.

[dmikusa]

You want to add a settings.xml file and supply that through a binding. See instructions here.

Alternatively, you can share your local Maven cache & settings.xml file via a volume mount. This only works with pack or Spring Boot builds though. It won't work with kpack, because there's no persistent local system.

[ajdergute]

Oh I think you missed me. I already provide a custom settings.xml via binding.

I want to download maven binary itself from a mirror.

[loewenstein]

I suppose https://github.com/paketo-buildpacks/maven#type-dependency-mapping will be your friend then.

[ajdergute]

I don't know why I missed that in the first place. Yes this is the option I'm looking for.

The fact that buildpacks take care that my build tools are up to date, is very cool. This is one reason I'm decided to use buildpacks. If I then manually set a binding, I'm again in charge to update this binding. Thus I'm not going to use it.

Imho this requirement is not specific to maven, therefore the discussion should take place at another level.

As my question is answered, this issue is closed.

[loewenstein]

Bindings for dependencies primarily exist I believe (I am not a maintainer) to support environments that have no access to the original site. You are actually forced to provide and use the very same version that the buildpack brings - bindings can change the URL, but not the SHA of the artefact.

[dmikusa]

You could use a dependency-mapping. That would allow you to point to a different location and fetch Maven binaries from there, but dependency mappings are painful. That's something Paketo is working to improve.

In the short term, I would suggest using Maven wrapper in your project. It's beneficial for other reasons, but the wrapper has ways to point to an alternative location for Maven binaries.

[ajdergute]

Thanks a lot. For maven I will switch to maven wrapper. Yes bindings are useful, but painful in my case. The scope of my original question was a bit wider. For additional binaries, e.g. JRE I will play around with squid caching proxy. Hope a more elegant solution in future will be available in buildpacks.

[dmikusa]

@ajdergute - Tentatively, we're looking at something like the proposal in this doc: https://docs.google.com/document/d/1g5rRW-oE_v8Gdvz-CiCOK9z2rxg6L5XniKI25Zq2j6M/edit. Feel free to drop in any comments.

[ajdergute]

@dmikusa this is a great proposal. I've nothing to add.