Resolve dependencies

Configure an Artifex repository in your build as a Maven repository or a Gradle repository.

Add the repository to Maven

In pom.xml:

<repositories>
  <repository>
    <id>artifex</id>
    <url>https://artifex.soh.gg/maven/OWNER/REPOSITORY_NAME/</url>
    <releases><enabled>true</enabled></releases>
    <snapshots><enabled>true</enabled></snapshots>
  </repository>
</repositories>

Replace the following:

• OWNER: the username of the repository owner
• REPOSITORY_NAME: the repository name

For a repository that holds Maven plugins, add the same entry under pluginRepositories.

Add the repository to Gradle

In settings.gradle.kts:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = "artifex"
            url = uri("https://artifex.soh.gg/maven/OWNER/REPOSITORY_NAME/")
        }
    }
}

In settings.gradle:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = 'artifex'
            url = 'https://artifex.soh.gg/maven/OWNER/REPOSITORY_NAME/'
        }
    }
}

Resolve from a private repository

A private repository needs a personal access token with at least the Read token access level that covers the repository. A public repository can be read without a token.

Maven reads credentials from ~/.m2/settings.xml and matches the server and repository by id:

<settings>
  <servers>
    <server>
      <id>artifex</id>
      <username>YOUR_USERNAME</username>
      <password>cs_pat_YOUR_TOKEN</password>
    </server>
  </servers>
</settings>

Gradle reads credentials from ~/.gradle/gradle.properties and matches the properties by the repository name:

artifexUsername=YOUR_USERNAME
artifexPassword=cs_pat_YOUR_TOKEN

maven {
    name = "artifex"
    url = uri("https://artifex.soh.gg/maven/OWNER/REPOSITORY_NAME/")
    credentials(PasswordCredentials::class)
}

Don't commit tokens to source control. Store them in your home directory or in the secrets of your continuous integration (CI) system, and read them from there.

What dependency resolution gets

A build can resolve the following from an Artifex repository:

• Versions that are stored in your repository.
• Versions that an upstream supplies. Artifex caches the files in your repository when a build first requests them.
• Maven metadata that merges stored and upstream versions, which a build uses to resolve timestamped snapshots.
• POMs and Gradle Module Metadata (.module) files that describe dependencies and variants.
• Artifacts and a checksum for every file, which the build uses to verify each download.

Artifex doesn't serve directory listings. A directory URL redirects to the repository pages.

Use one repository for dependencies

Instead of listing many repositories in every build, give one Artifex repository the upstreams that it needs, and configure your builds to use that repository. For more information, see Upstream repositories.

Advanced

Artifex accepts the token as the password for HTTP Basic authentication, which Maven and Gradle send. It also accepts the token as a bearer token in an Authorization header for custom clients.

A release file can't change, so it's served with a long max-age and immutable. Maven metadata and checksums are served with no-cache, so a client revalidates them. Every file is served with private, so shared caches don't store it, whether or not the repository is public. Artifex responds to conditional requests with 304 Not Modified and to range requests with 206 Partial Content, which resumable downloads need. A build that resumes a download sends If-Unmodified-Since with the time of the partial download. If the file has changed since then, Artifex responds 412 Precondition Failed, and the build downloads the file again.

Artifex responds to a request for a directory with 302 Found, redirecting to the repository's Browse page.

Every response carries a Server-Timing header with the request phases in milliseconds: auth, object, and r2. For a file fetched from an upstream for that request, the header also includes queued (waiting for a connection), upstream (the upstream's time to its response headers), and store. When a release file is served from the edge cache, the header reports cache;desc="hit" beside a cache phase. Browser developer tools show this information in the request timing.