ato/clojars-web — pull request #45 by xeqi (2012-05-10 02:44:30+00:00)
Title: act as maven repo supporting http uploads

I'd like to get a couple more eyes on this and make sure I'm not missing something.

---

### Functionality

This will let people deploy over http using the standard tools. Tests show it working using pomegranate, and for lein

```
:deploy-repositories {"clojars" {:url "http://www.clojars.org/repo"
:username ..
:password ..}
```
in a ```project.clj``` will let ```lein deploy clojars``` upload files (tested on lein master). I expect the functionality will work using ```mvn```'s deploy as well.

### Background

Repos are mostly just dumb servers. Aether will PUT files, GET the group/artifact's maven-metadata.xml and update the version info and then PUT the updated version.

Both "pom" and "jar" are artifacts. It is possible to ask just for the "pom" extension/type. The ssh setup only allows projects that have both.

Aether/pomegranate/lein will also PUT .shas for files.

### Potential Concerns

1. Since the server is dumb its possible for someone to create a dumb client, not using aether, and miss steps for having a good artifact.

2. The server has to read in the pom file to try and update the database. I think this would allow a large file to cause an OOM, though ssh might have the same issue.

3. The server accepts any file that looks like it could be an group/name/version/artifact. It needs to accept lots of them for jars, classifier jars, poms, shas, etc. Perhaps this should be restricted.

### Setup

Since clojars.org uses nginx for the /repo files, it needs a change in the config to pass PUTs to the ring app. I think http://forum.nginx.org/read.php?2,2414,47453#msg-47453 has the config settings that will do this.

I included ```clojars.repo/wrap-file-at``` middleware so it will work in dev/test/standalone.