Need for a "provider_url" attribute for the coordinates?

[jmini]

I hope this is the right place to start this discussion.

---

The ClearlyDefined coordinate system is a great way to have something that is not specific to a technology. The provider definition as a String seems to be limited with the explosion of services/suppliers to host dependency (Bintray, GitHub packages, …)

1) type : "maven" example:

The provider value mavencentral corresponds to the repository hosted at https://repo1.maven.org/maven2/.

I did not checked if other provider values are possible. If we take the Gradle built-in shorthand notations, there is also:

Value	Url
jcenter	https://jcenter.bintray.com/
google	https://dl.google.com/dl/android/maven2/

If we look at the list of top indexed repositories made by the mvnrepository.com website, we also additional possible values:

Value	Url
springio-libs-release	https://repo.spring.io/libs-release/
springio-plugins-release	https://repo.spring.io/plugins-release/
sonatype-releases	https://oss.sonatype.org/content/repositories/releases/
jboss-ea	https://mvnrepository.com/repos/jboss-ea
jboss-releases	https://repository.jboss.org/nexus/content/repositories/releases/
jenkins-releases	https://repo.jenkins-ci.org/releases/
...

But there is no way all possible values can be defined as a String constant.

Company or organization can defined their own maven repository and use it as part of their build.

2) type : "npm" example:

The value npmjs correspond to the url:

Value	Url
npmjs	https://registry.npmjs.org/

Yarn is often using an other repository:

Value	Url
yarnpkg	https://registry.yarnpkg.com/

3) type : "git" example:

github.com isn't the only git provider. There are other big open source providers (gitlab, bitbucket, …) and again every organization/company can have its own git server.

...

---

The provider String value is convenient but limited. Is there a list of the accepted values?

When a repository is not part of the list is could be replaced by a provider_url attribute, to support cases where a dependency comes from a small unknown repository.

---

This might be related to #119