Open source software emerges when people work in unison to create something greater than any one of them could create on their own. While the result may always be a collective work, the contributions and sacrifices that make a project thrive are always individual. These contributions deserve recognition. Sonatype will be paying tribute to the members of the Java open source community, who dedicate themselves to improving these projects. We’ll do so by featuring them in our new Community Spotlight each month. This month’s spotlight is on Manfred Moser of simpligility technologies.

If there is someone you would like to nominate for the community spotlight, please don’t hesitate to contact us at communityspotlight@sonatype.com. Thank you!

Manfred Moser – Kicking Apps and Taking Names

We have had the pleasure of working directly with Manfred Moser for the better part of a year and have been familiar with his work for much longer. Given Manfred’s constant and continuous work with the community we are sure many of you know him but for those that don’t, here is a little bit of background on Manfred.

Manfred has been professionally developing software in Java since 2003 and is a self-proclaimed open source fanatic, as well as an Android application developer, consultant, author and speaker. He has a long history of developing software in Internet, enterprise and mobile spaces. He is now working as an Android application developer and consultant with his own company, simpligility technologies.

simpligility technologies brings simplicity and agility to software development, processes, products and customers. With Manfred’s engineering background, teaching experience and passion for tools and infrastructure, he loves helping and mentoring other developers and development teams. He is able to understand complex requirements, business processes and software systems and cut through all the distractions to the core purpose and aim of an application. With this background simpligility offers a myriad of helpful consulting services.

We have been very lucky to work with Manfred on a number of projects. He is a core committer to the Android Maven Plugin and has co-authored our Sonatype book Maven: The Complete Reference, where he recently revamped the Maven Android chapter.  He is a Hudson committer and co-authored the new Hudson Book with Tim O’Brien.  Manfred is also a core contributor to our brand new Nexus Best Practices training course materials.

Manfred is the founder of the Vancouver Island Java User Group in Victoria, BC and in addition to presenting at java user group meetings, he has also presented at a number of conferences around the world. His next appearance will be at AnDevCon II in San Francisco this week from November 6 to 9, 2011.  If you plan to be there, we highly recommend popping into at least one of his sessions. The two sessions Manfred will be leading are: Taking Advantage of Apache Maven for Your Android Builds and Testing Android Apps – Going from Zero to Hero.

You can follow Manfred on twitter @simpligility or read the simpligility blog here.

We would like to thank Manfred for all his hard work and contributions! Thank you Manfred!

Sonatype makes it easy to add your projects to the Central Repository with a free, public hosting service called OSSRH. We first blogged about this back in 2009, but given the growth in the community, we thought some of you may not have seen that post, so we decided to update it.

At Sonatype, we want to make synchronizing and publishing your artifacts to Central easier and to improve the quality of repository metadata for everyone at the same time. To facilitate this, we offer a dedicated instance of Sonatype Pro for Nexus at http://oss.sonatype.org specifically to host the artifacts of open source projects. In this post, I talk about the process of creating a repository for your open source projects and publishing artifacts so that they will be available from the Central Repository.

This service has been available since 2009 and includes many projects such as Plexus, Jetty, Google Guice, Spring and Ehcache (Greg wrote about his experience with migrating to oss.sonatype.org). We have tooling in place to make it easy for us to process a larger set of requests, so we invite everyone to use this resource. As of October, 2011, we have over 1,500 projects using this repository on a daily basis.

To get the process started, go here. We’ll setup a release and snapshot repository for your project, along with the appropriate configuration to allow you to use the staging features for your releases. If you have an existing repository somewhere, we can migrate that for you too. We’ll even help you add artifacts to Central that you use, but don’t necessarily own — assuming of course that it doesn’t violate the projects license.

The system allows customizable rules to be run during the staging process, which allows us to automatically check things like valid pgp signatures and correct POM parsing. This will ensure that your users have the best experience possible when using your artifacts, and relieve some of the manual validation on your side — a win for everyone.

On the technical details, this instance gets its network connection via Contegix‘s high availability network, the same one running Central, Codehaus.org and Atlassian.com. New Relic has donated monitoring services to help us monitor and tune this instance of Nexus. Since OSSRH is hosted on the same infrastructure as the Central Repository, we are able to frequently synchronize the repositories.

Next time you need to add a project to the Central Repository, you’ll know how.

Sonatype is excited to announce that we’ve teamed up with Oracle to bring Java.net open-source projects to the Central Repository, the industry-leading source for open source Java components used by over 40,000 development organizations daily.

Java.net projects such as GlassFish and others are now included in the Central Repository, making it easier than ever for you to locate and download Java.net components without the workarounds or advanced configurations previously required. You’ll be able to leverage Java.net project assets to deliver applications faster, at a higher quality, and with less risk.

The Sonatype team worked closely with Oracle during the past year to evaluate existing Java.net legacy repositories, clean-up metadata and unite disparate content into a single site.   Java.net project owners can now easily automate and control synchronization of their project artifacts to the Central Repository through a hosted version of Sonatype Pro™ for Nexus donated by Sonatype to the project.

Read more about this exciting move in our press release and this article in Dr. Dobbs.

Sonatype recently released a free beta version of the Sonatype Insight Plugin for Eclipse that allows you to more efficiently manage and select Java components.  It is part of the Sonatype Insight product line that helps organizations take advantage of open source-based development while improving quality and reducing security and licensing risks.

See what components are used, which versions, and when updates are available

We want to make component based development as easy as possible by providing you the tools to choose the right components from the beginning to speed development, improve quality, and reduce costly rework. This plugin, the first of a series of development tools, helps you tame the issues typically associated with utilizing open source Java components, including:

• Determining when new component versions are available and making informed update decisions
• Understanding what versions of each component are used in your project
• Identifying where specific components are used
• Updating components throughout your project

The plugin is build tool agnostic, and so works with all Java projects in general (Java, PDE, Maven, etc.).

This is just the beginning. We’ll be adding features to help you choose components that meet your security, quality, and licensing standards by providing useful information about each component right in the IDE.  For example, we’ll alert you when a component, or one of its dependencies has known security vulnerabilities. You’ll also be able to tell how each component or dependency is licensed without having to hunt through the code yourself.

So tame your dependencies today and get the Sonatype Insight Plugin for Eclipse.

We’ve made several improvements to the Central Repository (Maven Central) to support the incredible growth in both the number of components and the number of developers using it. If you use specific IPs to allow access to Central, you’ll need to update your firewall as described below.

Since 2007, Central has been hosted at Contegix in a shared rack with 100mbps data connections to the Internet. We’ve worked with Contegix to acquire a new dedicated switch that will have a 1gb connection directly to their core routers. The routing to the switches is done at the Layer 3 (IP) level and this means we are moving to a new dedicated ip subnet:

• 207.223.241.64/27 (207.223.241.65 – 207.223.241.95)

In addition to the network upgrade, we’ve added an entirely new tool to our belts: Dyn (formerly DynDNS.com) is partnering with us to provide active monitoring, failover and global load balancing along with enterprise DNS services for maven.org via their DynECT Managed DNS solution. DNS resolution time should be noticeably faster as Dyn has DNS servers all around the world.

Availability will be improved as we have added geographic diversity with servers located in both the US and the UK. The DynECT Active monitoring service monitors http://repo1.maven.org/maven2 every 60 seconds and if any timeouts or errors are detected, the system will instantly switch over to alternate Central servers.

Although traffic to Central from Europe represents nearly 50% of overall load, the UK servers are serving less than 2%. This means most of our European users aren’t using the http://uk.maven.org/maven2 urls directly. DynECT has a load balancing solution, Global Server Load Balancer (GSLB), that will transparently direct traffic to our servers based on the user’s location. While our bandwidth costs are higher in the UK, the enhanced experience for almost half of our users is well worth the investment.

Firewall Updates May Be Required

These changes that provide the community benefit of increased stability, uptime and geographic load balancing required us to change our IP addressing such that we can no longer offer a single, static IP address for Central.

If your organization utilizes firewall rules with specific IPs, please allow this list so that you won’t be affected by any failover or balancing that may occur:

• 207.223.241.90 : Current US primary
• 207.223.241.91 : Current US staging
• 207.223.241.92 : Current US standby
• 207.223.241.64/27 (207.223.241.65 – 207.223.241.95) Future US Subnet
• 89.167.251.252: UK Primary
• 89.167.251.253: UK standby
• 89.167.251.249: UK standby

We anticipate the cutover to the new switch and IP addresses to occur between August 1, 2011 and August 5th, 2011. Shortly after that, we will slowly start to roll out the global load balancing. As long as you have allowed the IPs listed above and use the http://repo1.maven.org/maven2 url in your systems, the only things you should notice are faster resolution and download times.

Thanks again to Contegix and Dyn for helping us to provide enterprise level services to the development community.

Since its release in January, the Maven Central website (http://search.maven.org) has provided Apache Maven users with:

• Search functionality that allows one to quickly track down artifacts and their dependency details when trying to resolve build problems.
• Browse functionality that aids in discovery of new artifacts to use in projects.

In the intervening months, Sonatype has focused its efforts on improving the usability of the Maven Central user interface in the hopes of making it the first place users look when trying to find an artifact.  Recently, users who have reaped the benefits of using the Maven Central website have asked about interacting programmatically with the search functionality.

If you pay attention to your web browser’s address bar when conducting searches on Maven Central, you can already see that a REST-style API exists.  For example, searching for “guice” from the main search box results in the following URL being generated (the following URL’s are NOT URL-encoded for the sake of readability):

• http://search.maven.org/#search|ga|1|guice

Translating the search request into English, that URL requests a basic search for any artifact (irrespective of version) containing the word “guice” in either the groupId or artifactId, returning only the first page of results.  Each row of the results shows the latest version of the artifact and the date the artifact was last updated as well as any classifiers associated with the artifact.

You can build up the complete library of search requests simply by paying attention to your web browser’s address field as you use the Maven Central website.  For the sake of convenience, we’ve collected all the URLs that make up Maven Central’s search API in a document available here.

Sadly, these URL’s are still only useful when requesting them via web browser.  They are links that can be bookmarked or e-mailed, but they do NOT work when using a non-browser agent like wget or curl.  The Maven Central user interface is essentially a browser-based application that uses Javascript to make asynchronous requests to yet another set of URL’s.  Once you make a request that looks like the URL above, the browser fires off the actual request to another Maven Central URL responsible for conducting the search and returning results that are formatted by the browser.

The sample request above, when converted to an actual Maven Central search request, looks like this:

• http://search.maven.org/solrsearch/select?q=guice&rows=20&wt=json

The actual text of your query goes in the appropriately named “q” parameter, the “rows” parameter restricts the results to a smaller number than the full result set, and the “wt” parameter can be either “xml” or “json,” depending on how your application prefers to handle results.

Some useful examples appear below.  Again, please refer to the API Guide for a complete listing:

• Fully-qualified classname search – http://search.maven.org/solrsearch/select?q=fc:”org.specs.runner.JUnit”&rows=20&wt=json
• GroupId and artifactId search that returns all available artifact versions – http://search.maven.org/solrsearch/select?q=g:”org.apache.maven.indexer”+AND+a:”maven-indexer”&rows=20&core=gav
• SHA1 search (you would need to pre-calculate the SHA1 before sending the request to Maven Central) – http://search.maven.org/solrsearch/select?q=1:”2d3c16092663da9041b171b8d3627cbafa8f0cb1″&rows=20&wt=json

In an upcoming post, I’ll describe the architecture behind Maven Central that makes all this functionality possible.

Sonatype has released the latest version of our industry leading repository manager – Nexus 1.9.1

This post outlines some of the new features available in all 1.9 releases of both Nexus Professional and Nexus Open Source. This release has a lot of important, under-the-hood changes – including a number of changes to the core infrastructure of Nexus to increase Maven 3 compatibility and to incorporate open source libraries for repository interaction (Aether and Maven Indexer). In addition to a wide array of fixes and features in Nexus Open Source, you can now use Nexus Professional to analyze Maven Dependencies.

• Download Nexus Professional 1.9.1
• Download Nexus Open Source 1.9.1

Changes in Nexus Professional 1.9.1

Nexus Professional has the following key benefits.  For a complete list of all features added and bugs fixed in Nexus Professional 1.9.1, see the official release notes (note: release notes require a log-in).

• Moved the Custom Metadata Plugin to optional plugins – This Custom Metadata plugin is now shipped as an optional dependency. If you are using the Custom Metadata plugin you will need to copy this plugin from the optional dependencies directory to the plugins directory. Nexus will then start up this plugin the next time it is restarted.
• The New Maven Module Dependency Report – Nexus Professional adds a helpful report for people browsing the repository. For the first time, you can click on an artifact and see a report of Maven dependencies. From this report you can click through to search for dependencies.

Changes in Nexus Open Source

Nexus Open Source 1.9.1 contains the following new features and updated capabilities. We’ve summarized some of the major features and bug fixes for your convenience. If you are looking for more details about a particular feature or fix, read the full release notes for a comprehensive list of features added and bugs fixed.

• New Nexus Archetype Plugin - Nexus 1.9.1 will now add any Maven Archetypes you deploy to your own repositories to the archetype catalog. Once an archetype is available in the archetype catalog, you can then access archetypes using tools like m2eclipse, which reference the archetype catalog when creating a new project.
• Uses the Maven Indexer - Sonatype has successfully completed the donation of the Nexus Indexer to the Apache Software Foundation, and we are integrating this newly donated “Maven Indexer” in this release of Nexus. For more information, read this post.
• Improvements to the Roles and Permissions Interface - The Nexus team spend a considerable amount of time trying to simplify the Roles and Permissions interface based on user feedback. We’ve tried to make it easier to understand at first glance, and we’re also tried to reduce the amount of work necessary to make changes to roles and permissions.
• Integrated Aether - Aether is a new open source library designed to capture best practices for retrieving information from Maven repositories. It provides a clean interface and manages fetching both metadata and artifacts. This version of Nexus incorporates Aether and replaces Mercury. Integrating Aether has also solved a number of minor issues involving Maven metadata and compatibility with Maven 3.
• Switched to Java 6 - Nexus has upgraded to Java 6.
• Nexus Upgraded Security from JSecurity to Apache Shiro - As an end-user you shouldn’t notice many changes in the interface to support this migration, but if you are developing custom security realms for Nexus, this post describes some of the changes you need to make to support the move to Shiro. Note: After this upgrade, both first name and last name are required fields for a user. If you have an existing user that only have one name (“Administrator”), you will need to supply a first and last name for this user if you ever edit this user through Nexus UI.
• Added robots.txt to bundle to stop public repos from getting crawled
• Improved Reindexing Performance - Reindexing performance has been considerably improved, achieving a nearly 2x speed up for certain repositories.
• Switched to the Affero General Public License - Nexus Open Source is now covered under the Affero General Public License. For more information about this switch see this post.
• Added a Start-up Script for 64-bit windows Platforms – If you are running Nexus on a 64-bit Window platform, you can now start Nexus with a 64-bit Windows JSW startup wrapper.

For information on upgrading Nexus, click here.

EclipseCon 2011 is approaching quickly, but it’s not too late to make plans to head to Santa Clara, California this month!

EclipseCon is the conference for anyone involved in Eclipse. As a proud member of the Eclipse Foundation, Sonatype is looking forward to another year of great talks, tutorials and BOF’s. We will be hosting a number of extended workshops as well as talks in the Cypress Room all day on Tuesday, March 22, 2011.

Sonatype founder Jason van Zyl will be giving a presentation on Next Generation Development Infrastructure with Maven, m2eclipse, Nexus & Hudson.

Presentation details:

All development organizations eventually converge on a set of tools to reduce costs, lower onboarding time, and leverage knowledge in strong communities to create standard processes. To this end we see in many organizations the emergence of a standard development stack consisting of Maven, m2eclipse, Nexus & Hudson. In this talk, Jason van Zyl, Founder of the Apache Maven project, will discuss the future of Maven and specifically Maven 3.x, the rapidly approaching m2eclipse 1.0 release, the recent Nexus 1.9 release and roadmap, and emerging tools such as Maven Shell and Polyglot Maven. Sonatype itself leverages this stack on a daily basis and this discussion will focus not only on the tools individually, but how they can work together to create a best practices approach to building and delivering your software in your organization.

Event details:

• Date: March 21-24, 2011
• Location: Hyatt Regency Santa Clara, CA
• Event website: http://www.eclipsecon.org/2011/

Stay tuned to the Sonatype blog for updates on Sonatype’s talks and presentations at EclipseCon 2011. And for the latest news and updates from the Sonatype team, follow us on Twitter @SonatypeCM.

First, I’d like to address some misinformation. The use of Github itself was never an issue. It was how the original movement of the sources to Github was executed, and why, that created tension. Github is just a tool and it is a better choice for source control, at least in the short term, for several reasons:

• Rich REST API: Good for IDE and tooling integration and will allow some cool workflows which can empower contributors.
• Known quantity: Developers are very familiar with Github and its workflows. It’s easy for developers to interact with us by forking, making modifications, and submitting pull requests.
• Git repositories are available over HTTPS which makes collaboration at larger organizations easier.
• SVN interoperability: There are still many developers who are comfortable with their SVN tool chain and Github makes working with Git and SVN simultaneously a possibility

We proposed using Github on the Hudson list, and in short order agreement was reached and the move was initiated. Winston did the infrastructure work last night to push the sources for Hudson over to Github. It was really that Simple. It’s amazing how smoothly things go when you clearly communicate your intentions to all stakeholders. We hope to keep improving the infrastructure for Hudson so if you’re interested please join the Hudson Dev list!

You can also keep track of Hudson developments by following us on Twitter!

Today we started rolling out the first of our proposed JSR-330 Dependency Injection changes to Hudson back into the Hudson community. We’re giving it back because we think it is going to make a huge difference for Hudson’s future development. As more and more libraries move to JSR-330, we’re going to see a lot of possibilities open up because of these changes. With today’s donation, we’re making it easier to extend Hudson, we’re reducing the effort required to write a Hudson plugin, and we’re helping to put in a new foundation for the next level of Hudson interoperability and performance.

What does this mean for you as an end-user?

Guice is emerging as a lightweight Dependency Injection standard. We’ve moved the core of Maven to Guice over the past two years and it has dramatically increased performance and opened up possibility for integration with other tools and libraries. Since Guice is implementing JSR-330 standards, what we’re really doing with this effort is moving Hudson to a more standard, more maintainable architecture. As an end-user, you will likely notice increased stability as the core becomes more modular, easier to maintain and test. You should also expect greater integration with other tools that can speak the JSR-330 standard. This includes components that use both Guice and the Spring Framework.

Our Plan for JSR-330 Integration Going Forward

We’ve been working on decoupling both our JSR-330 and JAXRS work from our commercial version of Hudson for a couple of months. Our current focus is to allow Hudson plugins to take advantage of the JSR-330 Dependency Injection standard and then work toward using JSR-330, via Guice, in the core of Hudson itself. We have opened the Github repository containing the Hudson JSR-330 work which also contains a small example of a [Hudson Plugin written using JSR-330].

We’ve been using this new Hudson JSR-330 mechanism to create our JAX-RS (RESTful Web) integration, and our Maven 3.x integration. We will be working as fast as we can to propose and deliver our JSR-330 integration, JAX-RS integration, and our Maven 3.x integration back to the Hudson Community. Stuart McCulloch, who has been working on our Guice strategy, will be doing this work and following up with proposals on the Hudson Development list. Jeanfrancois Arcand is working on a REST framework, based on Jersey, that we will be proposing for integration into Hudson which is how we see webservices working in Hudson going forward.

Our GWT-based UI for our Maven integration relies upon these REST services, and our GWT-based Maven 3.x builder also uses JAX-RS as a communication channel back to the server. While it is unlikely that we will be able to stop using Jelly completely in the near future, this work will set the stage for a Hudson that is based entirely on RESTful web services. This isn’t easy work, we’re trying to set the foundation for future UI while maintaining compatibility for plugins that continue to use Jelly. Jeanfrancois is also looking at the integration of Atmosphere to make the standard pages in Hudson more efficient with respect to communication to the server.

So this is just the start of what we said we would deliver. More pieces will be released as they are ready. If you are interested, please take a look at the JSR-330 integration work we’ve done and look forward to more posts about JSR330 next week! If you have any feedback, please provide your comments or email questions. We’re excited about the work that has been done and the work yet to come.