Sonatype Blog » artifactory

Secure Central Connectivity – Artifactory & Archiva Now Supported

Mark Troester — Tue, 15 Jan 2013 16:20:31 +0000

Keeping with our desire to protect the entire Central Repository ecosystem, SSL connectivity to the Central Repository from JFrog Artifactory or Apache Archiva is now available.

We’re using SSL because it is the standard mechanism for protecting web traffic – across the spectrum of Ecommerce, banking, health care, and so on. Providing SSL support for Central means that your components are no longer susceptible to man-in-the-middle attacks that could compromise the component. SSL also eliminates the potential for a hacker to gain visibility into your organization by tracking the components that you download for your development initiatives.

Given the tremendous growth of Central, and to better protect applications that are now largely built from OSS components, we’re making SSL connectivity to Central available to anyone regardless of their repository manager. SSL is now the default connectivity option for Nexus Pro users. SSL is available for other repository managers, such as Nexus OSS & Artifactory or Archiva, for a $10 donation that will be used to support open source foundations such as Apache and Eclipse.

After you register and make the $10 donation, a token will be provided that your organization can use to secure access to Central.

If you are an Artifactory, Archiva or Nexus OSS user, you can get SSL access here.

Archiva 1.4+ is required.

Artifactory 2.6.5 is required.

If you are an existing Nexus Pro customer, you can download the latest release from the support page.

Now Available: SSL Connectivity to Central

Brian Fox — Thu, 25 Oct 2012 15:15:33 +0000

We know how components from the Central Repository have become critical to your development efforts. We also know that you need to trust those components. Part of that trust is knowing that hackers don’t have visibility into the components you download or that they compromise components using a man-in-the middle or Cross Build Injection (XBI) attack.

We’re making SSL connectivity to Central available to anyone that downloads open source components regardless of the repository manager. Given the tremendous growth of Central, and the fact that modern applications are largely built from OSS components, this capability is likely to be leveraged by many organizations. SSL has become the standard mechanism for protecting web traffic – across the spectrum of Ecommerce, banking, health care, and so on. Providing SSL support for Central means that your components are no longer susceptible to man-in-the-middle attacks that could compromise the component. SSL also eliminates the potential for a hacker to gain visibility into your organization by tracking the components that you download for your development initiatives.

As of Nexus Pro 2.2 (available now), SSL is now the default connectivity option for Nexus Pro users. Because we take security of the ecosystem seriously, we aren’t stopping there, we’re making SSL connectivity to Central available to you even if you aren’t using Nexus Pro.

In order to ensure the highest level of performance for those who count on SSL, we are securing the service with a token. You can get a token for your organization simply by providing a $10 donation that will be donated to open source causes. For the first 60 days all donations will go to the Apache Software Foundation. After that, the donations will go to other open source foundations such as Eclipse. Sonatype will provide a donation on behalf of Nexus Pro customers since we’ve included SSL access to all Pro customers automatically.

If you happen to be using Nexus OSS (any version), support for the SSL token is included already. I’ve already reached out to the Artifactory and Archiva teams and they are working on the changes necessary to enable SSL to Central – we’ll let you know when that support is enabled. If you’re not using a repository manager at all, what are you waiting for?

If you are an existing Nexus Pro customer, you can download the latest release from the support page.

If you would like to make a donation to the open source community and get SSL access, you may do so here.

How to Migrate Repositories from Artifactory to Nexus

Tim O'Brien — Mon, 23 Aug 2010 06:00:21 +0000

Sonatype is pleased to announce version 1.5 of the Nexus Migration Plugin. This version contains an updated implementation of our Artifactory to Nexus migration tool. If you are currently running Artifactory and you want to migrate to Nexus, all you need to do is:

Create a System Export from Artifactory
Install Nexus with the Nexus Migration Plugin
Import Your Artifactory System Export to Nexus
Configure the Artifactory Bridge to seamlessly serve artifacts to existing clients

You can use the Nexus Migration Plugin with Nexus Open Source or Nexus Professional. To get started, download Nexus Open Source or Nexus Professional, then download the Nexus Migration Plugin. Read Appendix A of the Nexus Book and learn how to: