On 11-09-17 09:00 AM, Jason Pyeron wrote:
Is the metadata in the revision? Only export the revision. Defense, Healthcare,
life safety, large organizations, all of these type of organizations have rules,
we are trying to make Maven more adaptable so it can be used there on projectes
where the rules are enforced.
gap you list that repository in a<repository/> by pathname.
Then you have a forbiden delta from what is in the official record.
Or you maintain a repo manager on the secure side of the air
The repo manager was not in the official record.
gap and you publish it there.
This whole argument is totally a red herring. You will not be able to
have all artifacts in the SCM system. At least you have to specify the
tool chain to actually run the build including operating system, java
and so on.
These do not necessary have to be in the SCM system but have to be in
the official record for the filing.
It is totally feasible to add a repo manager as just another required
build tool and add a backup/export of the repository content as part of
the code that you put on the dvd. You could even just do a clean build
on a fresh machine and take a copy of the local repo. Or even create a
virtual machine image with the full setup.
It will work just fine off the grid. In fact with Maven it will run
better if you use a repo manager than without..
I have done that in the past for escrow services in the healthcare
industry fullfilling all requirements and passing various audits for ISO
and FDA approval.
The requirement you cite as part CMMI L3 and such does imho not really
exist in this strict sense of pure SCM storage. You have to be able to
do a reproducible build without anything beyond what you supply for
escrow .. but that has nothing to do with SCM. And if you controlling
the content of your repository for build reproducability is one of the
dedicated enterprise features of e.g. Nexus Pro (and others like
Artifactory).
Cludging something into Maven itself feels wrong to me.
manfred
http://simpligility.com
PS: also look at e.g. the Debian project and their integration with
Maven. It all build complete offline since this is part of their
requirement for bootstirapping so this kind of behaviour is already
possible.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org
