Maven/Gradle relevant in enterprise software projects

[u0206397]

As per title.

In many enterprise environments, developers are not permitted to connect their unprotected development machines to corporate network with Internet access, as these developers' machines are not configured securely and approved by the corporate IT security team to be on the network.

Thus, are Maven and Gradle with its dependency resolution feature relying on the Internet actually useful in enterprise software projects?

Some developers went to the extent of setting up a local repository server like Artifactory, but I think it's an overkill when all you want is to include a couple of .jar files from somewhere in a NetBeans or Eclipse project. It's like setting up a local Linux mirror server, when all you want is to install Linux on one machine. The effort does not warrant this in my opinion.

Any thoughts and comments?

 

[Azzizz81]

Where do the developers commit their code if they have no access to corporate network~¿

 

[davidktw]

As per title.

In many enterprise environments, developers are not permitted to connect their unprotected development machines to corporate network with Internet access, as these developers' machines are not configured securely and approved by the corporate IT security team to be on the network.

Thus, are Maven and Gradle with its dependency resolution feature relying on the Internet actually useful in enterprise software projects?

Some developers went to the extent of setting up a local repository server like Artifactory, but I think it's an overkill when all you want is to include a couple of .jar files from somewhere in a NetBeans or Eclipse project. It's like setting up a local Linux mirror server, when all you want is to install Linux on one machine. The effort does not warrant this in my opinion.

Any thoughts and comments?

In this case, hosting your own repo is more than just mirroring. It is a way to ensure consistency across the duration of projects, not necessarily just one. There may be also your own libraries that you want to distribute among projects and/or developers in a single project. Code versioning alone will not promote reusability; libraries, components, framework and systems will. At the same time, having your own repo helps to cut down on Internet bandwidth which may be limiting in an Enterprise environment, and also less dependencies on the team to kick start from scratch when Internet is not available.

If your infra team can’t keep up to this sort of development, it is a pure failure on their side, and if the development team need to resort to using mirror as a way to proxy things, it is not a waste of time. It is how real world works, and it is a choice between making things work or not. Hence the choice is yours, sit on it and suck thumb, or be proactive and get things moving when there are real impediments.

In my opinion, all those restriction is oxymoron. In the end, they just make creative developers do things behind their back. One can easily create an ad-hoc proxy that proxy out from one’s mobile phone tethering when one need to fill up project dependencies. Such network backdoors are so simple, unless they introduce cell signals jamming.

 

[u0206397]

Development team may have its own development and testing network without permission to hook up to Internet.

Not connected to the corporate network where production mail servers, web proxies and NAS are. This is where office workers access their emails and Internet, and they don't want the development team to mess anything up, or try anything new.

Hope this clarifies.

 

[davidktw]

Development team may have its own development and testing network without permission to hook up to Internet.

Not connected to the corporate network where production mail servers, web proxies and NAS are. This is where office workers access their emails and Internet, and they don't want the development team to mess anything up, or try anything new.

Hope this clarifies.

They could have implemented VLAN and control the traffic into the Internet. Whitelist only known and reputable repo and mirrors (hostname,ip,url) Control at firewall and http proxies. Put in an antivirus and malware scanner in the pipeline.

Hence when a developer is connected to this network. There is only very limited access to the Internet and all are predeclared to the infra team for approval.

 

[u0206397]

I think this is a infra, network and IT security policy issue. If they can allow it, then it's not a technical problem.

 

[BlackCube]

I don't think it's overkill.

Without internet, it's a little troublesome but not impossible. Although, it's quite irritating at times. Having said that, you can host your own git (gitblit), repo (archiva, nexus, ), ci (jenkins, gocd) and so on. Building enterprise project hardly include only a couple of jars. Having own repo also allows you to store multiple version of jar since active projects releases quite often, and their dependency.

Configure mvn to pull from your own centralized repo will cut down your time trying to search for jar, and so on.