How does Maven interact with different repositories?

Question

How does Maven interacts with different repositories like Nexus and Artifactory?

Is it done using their REST APIs? It is possible to resolve dependent artifacts to actual locations to get them from using these APIs, but the two APIs are somewhat different form each other (as far as i see [Artifactory] [Nexus]) and the repository definition element in Maven pom files does not contain a property to state the type of the repository.

So how does Maven resolves artifact's groupId, artifactId and version to an actual file in different repositories? Does these repositories implement some other standardized API that enables Maven to request files from them in an repository-agnostic way?

Answer 1

Yoy define repositories to search artifacts in 2 ways:

1) in your pom.xml in project section

<project>
    ....
    <repositories>
         <repository>
            ...
            <url>...</url>
         </repository>
    </repositories>
</project>

2) and/or in file $USER_HOME$/.m2/settings.xml (there are plenty examples on WEB)

Maven downloads artifacts from by constructing URL of artifact using repository URL and appending path according to artifact group, id, version, type and classifier. And converts dots in groupId into '/'

RepoUrl/groupId/artifactId/version/artifactId-version-classifier.type

Examples:

https://repository.apache.org/content/repositories/releases/commons-io/commons-io/2.4/commons-io-2.4.jar

https://repository.apache.org/content/repositories/releases/commons-io/commons-io/2.4/commons-io-2.4-sources.jar

https://repository.apache.org/content/repositories/releases/commons-io/commons-io/2.4/commons-io-2.4-javadoc.jar

This is convention and it's independent from Artifactory or Nexus. This is Maven. Everything is transfered through the HTTP or HTTPS. Additionally Maven handles MD5 and SHA1 files for security purposes.

Once downloaded, artifact stored in local repository on your workstation at $USER_HOME$/.m2/repositories (it have a structure similar to remote repository) that acts as a cache and proxy.

Typically Artifactory or Nexus are kind of local cache and proxy at company level with some functionality to manage it. Surely they host maven artifacts published by company developers.

Looks like a 3 levels of repositories: local - local company - global

Answer 2

Maven uses some kind of naming convention. In pom.xml you define a root URL of repository (e.g. http://download.java.net/maven/2/) and then maven is able to resolve an artifact by constructing a URL:

<root URL>/${group id where dots are replaced by slashes}/${artifact id}/${version}

So for the following dependency

<groupId>org.apache.lucene</groupId>
<artifactId>lucene-core</artifactId>
<version>2.0.0</version>

Maven will try to find poms and jar at http://download.java.net/maven/2/org/apache/lucene/lucene-core/2.0.0

That means every URI which follows this convention may serve as Maven repo.

Answer 3

maven uses normal http calls to interact with repositories. you don't need anything but an http server to serve a maven repository. maven relies on a specific directory hierarchy and a few metadata files. (the local on disk repository where maven caches files it has downloaded is the exact same format).