Resolve dependencies

A repository is a dependency source for Maven and Gradle. Point your build at its Maven address and resolve as you would from any other repository.

Add the repository to Maven

In pom.xml:

<repositories>
  <repository>
    <id>codesoh</id>
    <url>https://artifex.soh.gg/maven/OWNER/SLUG/</url>
    <releases><enabled>true</enabled></releases>
    <snapshots><enabled>true</enabled></snapshots>
  </repository>
</repositories>

For a repository that holds Maven plugins, add the same entry under pluginRepositories.

Add the repository to Gradle

In settings.gradle.kts:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = "codesoh"
            url = uri("https://artifex.soh.gg/maven/OWNER/SLUG/")
        }
    }
}

In settings.gradle:

dependencyResolutionManagement {
    repositories {
        mavenCentral()
        maven {
            name = 'codesoh'
            url = 'https://artifex.soh.gg/maven/OWNER/SLUG/'
        }
    }
}

Resolve from a private repository

A private repository needs a personal access token with at least read permission in that repository. A public repository needs no credentials.

Maven reads the credentials from ~/.m2/settings.xml, matched by the repository's id:

<settings>
  <servers>
    <server>
      <id>codesoh</id>
      <username>YOUR_HANDLE</username>
      <password>cs_pat_YOUR_TOKEN</password>
    </server>
  </servers>
</settings>

Gradle reads them from ~/.gradle/gradle.properties, matched by the repository's name:

codesohUsername=YOUR_HANDLE
codesohPassword=cs_pat_YOUR_TOKEN

maven {
    name = "codesoh"
    url = uri("https://artifex.soh.gg/maven/OWNER/SLUG/")
    credentials(PasswordCredentials::class)
}

Keep tokens out of your source repository. Put them in your home directory, or in the secret store of your CI system, and read them from there.

What a build gets

A build resolves the following from a repository:

• Versions that were deployed to it.
• Versions that an upstream supplies. The files are kept in the repository after the first build asks for them.
• Version lists that cover both, so a build sees one list.
• A checksum for every file, which your build uses to verify what it downloaded.

Directory listings aren't available. To look around, use the repository pages or search.

One repository for everything

Rather than listing many repositories in every build, give one Artifex repository the upstreams that it needs, and point your builds at it alone. For more information, see Upstream repositories.

Advanced

Artifex accepts the token as the password of HTTP Basic authentication, which is what Maven and Gradle send, and also as a bearer token in an Authorization header if you're writing your own client.

A release file is served with a long cache lifetime and marked immutable, because it can't change. Metadata and checksums are served with no-cache, so a client revalidates them. Artifex answers conditional requests with 304 Not Modified and range requests with 206 Partial Content, which is what resumable downloads need.

A request for a directory answers 404 Not Found with the message Directory listings aren't available. Request a file.