At RSA 2012, Wayne Jackson gave a short presentation focused on the security aspects of Sonatype Insight and the newly released Repository Health Check in Nexus Professional. This five minute overview gives you a sense of the magnitude of the problem we are trying to solve.

Here are some of the highlights from Wayne’s presentation followed by the video of his talk and his slide deck:

• “The benefits of ‘many eyeballs’ in open source does create better software but you can only leverage that if you know about it. That’s particularly troubling in the context of the fact that more than 80% of the modern software application is [comprised of] open source and the components that are used to build those applications are surprisingly complex.”
• “That complexity is compounded by the fact that when issues arise their implications are viral and the big problem is that when those issues are resolved in the root components the solutions are not [similarly viral] . Spring Beans 2.5.6 compromised 1400 open source components and God knows how many downstream applications. When Spring Beans 2.5.6 was fixed, none of the others were fixed.”
• “You can imagine the ripple effect of compromising open source. And the combination of things like the lack of notification infrastructure and the complexity of open source componentry is how you get situations like this. 6,982 organizations including the Dept of Homeland Security and several financial institutions are still using a 3 year old crypto library with an “as bad as it gets” Level 10 flaw that has known exploit code.”
• “Sonatype is creating an extraordinary infrastructure for finding out everything knowable about a given component. So that when flaws are discovered, we can know and we have the ability to deliver that knowledge into the tools that developers are using every day. This family of technologies is called Insight.”
• “Critical to that is the Central repository. Central houses hundreds of thousands of components from nearly every open source project in the world and it is used by tens of thousands of organizations.”

If you missed our latest webinar “Enterprise Repository Management” you can view a recorded version of the webinar here.

Now that you’re primed with knowledge, jump in and see what a repository can do for your development workflow:

• Download a free evaluation copy of Nexus Professional
• Learn more about repository management
• Contact a Sonatype representative for more information

If you have any questions about Nexus or repositories in general, we have engineers (not just sales guys) who would be happy to speak with you.

Sonatype has released the latest version of our industry leading repository manager – Nexus 1.9.1

This post outlines some of the new features available in all 1.9 releases of both Nexus Professional and Nexus Open Source. This release has a lot of important, under-the-hood changes – including a number of changes to the core infrastructure of Nexus to increase Maven 3 compatibility and to incorporate open source libraries for repository interaction (Aether and Maven Indexer). In addition to a wide array of fixes and features in Nexus Open Source, you can now use Nexus Professional to analyze Maven Dependencies.

• Download Nexus Professional 1.9.1
• Download Nexus Open Source 1.9.1

Changes in Nexus Professional 1.9.1

Nexus Professional has the following key benefits.  For a complete list of all features added and bugs fixed in Nexus Professional 1.9.1, see the official release notes (note: release notes require a log-in).

• Moved the Custom Metadata Plugin to optional plugins – This Custom Metadata plugin is now shipped as an optional dependency. If you are using the Custom Metadata plugin you will need to copy this plugin from the optional dependencies directory to the plugins directory. Nexus will then start up this plugin the next time it is restarted.
• The New Maven Module Dependency Report – Nexus Professional adds a helpful report for people browsing the repository. For the first time, you can click on an artifact and see a report of Maven dependencies. From this report you can click through to search for dependencies.

Changes in Nexus Open Source

Nexus Open Source 1.9.1 contains the following new features and updated capabilities. We’ve summarized some of the major features and bug fixes for your convenience. If you are looking for more details about a particular feature or fix, read the full release notes for a comprehensive list of features added and bugs fixed.

• New Nexus Archetype Plugin - Nexus 1.9.1 will now add any Maven Archetypes you deploy to your own repositories to the archetype catalog. Once an archetype is available in the archetype catalog, you can then access archetypes using tools like m2eclipse, which reference the archetype catalog when creating a new project.
• Uses the Maven Indexer - Sonatype has successfully completed the donation of the Nexus Indexer to the Apache Software Foundation, and we are integrating this newly donated “Maven Indexer” in this release of Nexus. For more information, read this post.
• Improvements to the Roles and Permissions Interface - The Nexus team spend a considerable amount of time trying to simplify the Roles and Permissions interface based on user feedback. We’ve tried to make it easier to understand at first glance, and we’re also tried to reduce the amount of work necessary to make changes to roles and permissions.
• Integrated Aether - Aether is a new open source library designed to capture best practices for retrieving information from Maven repositories. It provides a clean interface and manages fetching both metadata and artifacts. This version of Nexus incorporates Aether and replaces Mercury. Integrating Aether has also solved a number of minor issues involving Maven metadata and compatibility with Maven 3.
• Switched to Java 6 - Nexus has upgraded to Java 6.
• Nexus Upgraded Security from JSecurity to Apache Shiro - As an end-user you shouldn’t notice many changes in the interface to support this migration, but if you are developing custom security realms for Nexus, this post describes some of the changes you need to make to support the move to Shiro. Note: After this upgrade, both first name and last name are required fields for a user. If you have an existing user that only have one name (“Administrator”), you will need to supply a first and last name for this user if you ever edit this user through Nexus UI.
• Added robots.txt to bundle to stop public repos from getting crawled
• Improved Reindexing Performance - Reindexing performance has been considerably improved, achieving a nearly 2x speed up for certain repositories.
• Switched to the Affero General Public License - Nexus Open Source is now covered under the Affero General Public License. For more information about this switch see this post.
• Added a Start-up Script for 64-bit windows Platforms – If you are running Nexus on a 64-bit Window platform, you can now start Nexus with a 64-bit Windows JSW startup wrapper.

For information on upgrading Nexus, click here.

If you missed Sonatype’s latest webinar, the Future of Hudson Continuous Integration, you can catch the replay right on Sonatype.com.

To view the replay, click here.

Our next webinar – Hudson Continuous Integration with Sonatype Professional – is taking place on March 29. If your development team is looking for best practices for integrating Maven, Hudson and Nexus Professional this webinar is for you.

Sonatype Professional is the only integrated suite created for Maven-centric builds. The suite includes Sonatype Certified & Integrated Distributions of: Maven, Hudson, Nexus Professional, Eclipse Integration, Developer Onboarding as well as support from the experts. Register to learn how Sonatype Professional empowers development teams to realize the promise of agile through continuous integration, while reducing project risk.

• Date: Tuesday, March 29, 2011
• Time: 9:00 am Eastern Daylight Time (New York, GMT-04:00)
• Duration: 30 mins
• Presenter: Blaine Mincey, Sonatype Senior Systems Engineer
• Register for this webinar

Development teams often struggle to achieve the full promise of agile methodologies using their current tools. The Sonatype team wants to help change that.

Sonatype Professional is a suite of next generation development infrastructure software that extends the Maven ecosystem to improve both the speed and quality of Java development projects. Sonatype Professional integrates the m2eclipse, Nexus Professional, and Hudson-based continuous integration and adds unique developer onboarding functionality to get you productive fast.

Attend our webinar – Improving Developer Productivity with Sonatype Professional – to learn how this suite can help transform your software development process.

Webinar details:

• Date: Tuesday, March 8, 2011
• Time: 1:00 pm Eastern Standard Time (New York, GMT-05:00)
• Presenter: Blaine Mincey, Sonatype Senior Systems Engineer
• Register today!

For the latest news and updates from the Sonatype team, follow us on Twitter!

Sonatype books are the essential references for anyone working with Apache Maven, repository management, and integrating Maven with Eclipse.

Learn best practices, central concepts, and complete integration for Maven, Nexus Professional, and m2eclipse. Sonatype books offer the latest content for the software development tools you depend on.

The third book in our series of books available for downloading is Repository Management with Nexus.

Nexus Professional is a next-generation repository manager that can proxy remote repositories, host internal repositories, encourage collaboration, and increase efficiency.

Repository Management with Nexus walks you through the installation process for both the Open Source version of Nexus and Nexus Professional, and it covers important topics such as:

• Installing Nexus as a Service on a Linux Machine
• Nexus Best Practices
• Managing Security with Nexus’ Fully Customizable Role-based Authentication System
• Reading Nexus System Logs
• Installing Nexus as a WAR in an Existing Application Server
• Configuring Nexus Professional’s LDAP Authentication Realm
• Configuring Nexus Professional’s Staging and Procurement Features

To download Repository Management with Nexus, please click here.

Sonatype is pleased to announce the launch of Sonatype Professional, the only integrated development suite for Maven-centric Java development. Sonatype Professional integrates and enhances a range of popular open source technologies to streamline Java software development and is specifically designed to improve both the speed and quality of your Java builds. Sonatype Professional integrates the m2eclipse, Nexus Professional, and Matrix Professional (Hudson-based continuous integration) and adds unique developer onboarding functionality to get you productive fast.

Sonatype Professional is tightly integrated with the Eclipse development environment to streamline builds, artifact search and reuse, defect detection, and bug fixes. From within Eclipse, users can:

• Visually manage Maven
• Browse and search Nexus repositories
• Submit Hudson continuous integration jobs
• Receive real-time build and continuous integration alerts
• Jump quickly to broken code

To learn more click here.

Sonatype books are the essential references for anyone working with Apache Maven, repository management, and integrating Maven with Eclipse.

Learn best practices, central concepts, and complete integration for Maven, Nexus Professional, and m2eclipse. Sonatype books offer the latest content for the software development tools you depend on.

The first book in our series of books available for downloading is Maven by Example.

Learn by doing — Maven by Example walks you through the key concepts of the world’s leading project management tool.  This book covers key concepts of Apache Maven by building a sample multi-module Maven project which involves an object model, a database, a set of services, and a web application.

To learn more about Sonatype books, or to download Maven by Example, click here.

If you love Sonatype’s online books, it may be time to update your bookmarks!  Sonatype offers online books covering Maven, Nexus Professional, and Developing with Maven and Eclipse.  These books are the essential references for anyone working with Apache Maven, repository management, and integrating Maven with Eclipse.

Sonatype books are different.

We publish an updated version of the book each time there has been a change in the product it describes. This means that when you come to Sonatype to download a book on Nexus, Maven, or m2eclipse, you will be getting today’s book, up-to-date with the latest content.

Click your favourite book title for the latest copy:

Maven by Example

This book is an introduction to Apache Maven. It introduces the central concepts of Maven by building up a sample multi-module Maven project which involves an object model, a database, a set of services, and a web application.

Maven: The Complete Reference

This book is an essential reference for anyone working with Apache Maven. This book explores the details of the POM, Maven Settings, Maven Archetypes, and many other topics.

Repository Management with Nexus

Repository managers serve two purposes: they act as highly configurable proxies between your organization and the public Maven repositories and they also provide an organization with a deployment destination for your own generated artifacts. “Repository Management with Nexus” will walk you through the installation process for both the Open Source version of Nexus and Nexus Professional.

Developing with Eclipse and Maven

The m2eclipse plugin is fully documented in the free, online book Developing with Eclipse and Maven. This book covers the installation and configuration of the plugin as well as detailing some of the procedures you can use.

The last webinar in our series, Build Promotion with Nexus Professional, was a huge success. This week Sonatype’s Senior Systems Engineer Blaine Mincey is back to host another Nexus Professional webinar.  This webinar will be held this Thursday September 9 at 10:30am PDT, 1:30pm EST.

This webinar is an introduction to the Build Promotion capabilities of Nexus Professional, the industry leading repository manager to help companies acquire, manage, and report on open source software artifacts in their software development projects.

If you release software, you will often need to test a release before deploying it to a production system or an externally accessible repository. For example, if you are developing a large, enterprise web application you may want to stage a release candidate to a production system and perform a series of rigorous tests before a release manager makes a decision to either return a system to development or deploy a system to production.

The Build Promotion feature in Nexus Professional allows an organization to create a temporary staging repository and to manage the promotion of artifacts from a staging repository to a release repository. This ability to create an isolated, release candidate repository that can be discarded or promoted makes it possible to support the decisions that go into certifying a release.

To register for this webinar, please click here.