Artifactory Migration
The Grails central plugin repository is a custom repository backed by SVN. It has served Grails well but has a number of significant problems:
- Not Maven compatible - Maven users cannot resolve plugins from the repository and Grails plugins have to be repacked for Maven
- No permissions model - Any user with permission the repository can publish any plugin
- Size issues - The repository has become huge, and includes giga-bytes of data. Duplication of Jars stored in it is an issue here.
Migrate to Artifactory Online for repository management http://repo.grails.org
There are a number of challenges and facets to this migration. Each of these is discussed below.
Currently versions 1.3 and above of Grails can download plugins from Maven compatible repositories, but 1.2 and below cannot.
Shifting to Artifactory will mean that users on older versions of Grails cannot get plugin updates. A suggestion is to rewrite the URLs that older versions of Grails request to download plugins.
All versions of Grails since 1.1 use http://plugins.grails.org as the root of the custom repository. Request for a URL such as http://plugins.grails.org/grails-atomikos/tags/LATEST_RELEASE/grails-atomikos-1.0.zip should be rewritten into a Maven compatible URL.
Older versions of Grails contain the "release-plugin" script which is hard coded to publish to SVN. Newer versions of Grails (since 2.0) use the release plugin.
Users of older versions of Grails will have to install the Release plugin to continue publishing plugins, whilst everyone else will simply have to update to the latest version of the Release plugin. The new version will publish to our Artifactory repository by default, although it will retain support for publishing to Subversion repositories as well.
This process will be quite disruptive for plugin authors, so we have to make sure that as many as possible are prepared when the changeover happens. We should have a minimum 2 months lead time during which we send emails, tweet, etc. about the impending change. We could also have a message displayed on the plugin portal pages explaining the same. This is all necessary because when the changeover occurs, plugin authors won't get any helpful messages about why they can't publish plugins any more.
Every version of Grails currently reads a static master plugin list from the the location http://plugins.grails.org/.plugin-meta/plugins-list.xml
Since this will not be supported or generated in the Artifactory repository this will instead be read from the Grails.org website. The URL will be re-written onto Grails.org which will generate the data from the latest available on the plugin portal.
Currently there is well over a gigabyte of plugins published to SVN at http://plugins.grails.org.
A sync job will be set up to do a one time sync from this URL to the Artifactory repository, after which the SVN repository will be made read-only.
Artifactory has the capability to remove duplicate files and store only the necessary artifacts.
Of course, making the Subversion repository read-only will mean that plugin authors will no longer be able to use the repository for hosting their source code. We will have to create migration guides for moving plugin sources to the main alternative providers: GitHub, Google Code and any others that developers use. A couple of generic git and svn migration guides would be useful as well.
To publish a plugin you currently have to have a Xircles account with permission to the grails-plugins repository.
This requirement will be eliminated and instead users will be granted permission based on their http://grails.org account.
In order to control who can publish what plugin, Artifactory permission targets will be used.