Using closed-source dependencies with Maven

Question

I have a closed-source project that I would like to build using Maven. It has a dependency on two java libraries which are not available in any public repository that I\'ve bee

Answer 1

It turns out that Manfred's answer didn't quite work for me. The app compiled, but it did not run on my Android device because the required google analytics classes were missing.

Following the links he supplied, I discovered this solution which is actually a little cleaner and worked properly.

In summary, I added the following dependencies to my pom.xml. The groupId, artifactId, and version were all made up by me using reasonable values:

<dependencies>
    ...
    <dependency>
        <groupId>com.google.android.apps.analytics</groupId>
        <artifactId>libGoogleAnalytics</artifactId>
        <version>1.1</version>
    </dependency>
    <dependency>
        <groupId>com.flurry</groupId>
        <artifactId>FlurryAgent</artifactId>
        <version>1.24</version>
    </dependency>
</dependencies>

I then added a repository definition for where I'm storing the third party dependencies in my project's source tree:

    <repository>
        <id>third.party.closed.source.repo</id>
        <url>file://${basedir}/../maven_repo_3rd_party</url>
    </repository>

I then moved the jar files to the following location:

./maven_repo_3rd_party/com/google/android/apps/analytics/libGoogleAnalytics/1.1/libGoogleAnalytics-1.1.jar
./maven_repo_3rd_party/com/flurry/FlurryAgent/1.24/FlurryAgent-1.24.jar

Once I did that, my project compiled and ran exactly as if the third party dependencies were resolved from an official maven repo.

Answer 2

While I really think you should use a dedicated repository server and Sean Patrick is totally right about it here is a hack to get it to work.

Put the jar file in a libs folder just like you did in the days gone by (remember Ant.. ouch) .. and then declare a dependency to each jar using the scope system and a path.

An example can I did this for is described here

http://www.simpligility.com/2010/01/how-to-mavenize-a-typical-web-application-build-jasperserver-3-7-sample-webapp/

Specifically a dependency would e.g. look like this

<dependency>
  <groupId>jasperreports</groupId>
  <artifactId>jasperreports-chart-themes</artifactId>
  <version>3.7.0</version>
  <scope>system</scope>
  <systemPath>${project.basedir}/src/main/webapp/WEB-INF/lib/jasperreports-chart-themes-3.7.0.jar</systemPath>
</dependency

Oh and now that I told you how to do it keep in mind that this is BAD practice and has a bunch of issues but it will work...

Answer 3

Use A dedicated Repository Server

As per maven's Internal Repositories documentation, I could set up a repository server somewhere and put the binaries there, which all the developers would then access.

Exactly. Set up a maven repository server with several repositories, e.g. these:

• internal-releases
• internal-snapshots
• external-opensource
• external-closedsource (this is where the lib we are talking about goes)

But that means I have a new server to maintain (or at least a new website on an existing server). It also means I have to worry about permissions to ensure that outside parties can't access the repository.

Yes, but a company that does serious software development should have an infrastructure like that. But if your company is serious about using Maven, there should probably also be a dedicated position for configuration management, and that person should administer this server.

It also means I have to worry about backups and availability now so that developers don't run into hiccoughs if the repository is unavailable.

The standard repository servers (e.g. Sonatype Nexus) are rock solid. If it ever hangs, just restart the app server / servlet container it's running on. Also, once developers have downloaded a library from the repo, it remains in the local repo, so even if the repo is down, there shouldn't be a problem (but you can't reference a new dependency when the server is down).

---

Use your existing SCM as a maven repository

OK, if you really want to use your SCM as a maven repo, here's how to do it:

http://maven-svn-wagon.googlecode.com/svn/site/index.html

This article describes how to setup an SVN-based maven repository for your own project. But if you want to deploy a third-party to the repo, just create a pom with the config mentioned here and use that pom to deploy:deploy-file your library.

(There are other wagon / scm implementations also, and the configuration is slightly different, but the solution remains the same: create a pom according to the wagon implementation you are using and then do deploy:deploy-file (see more info on the usage page)