Maven and dependencies NOT in repository

Question

We have a dependency third-party library that is available online in jar form, but it is not in Maven Repository, or known to be in any other repository.

How can we use pom.xml to auto-retrieve this dependency, based on a URL?

We don't want to store it in our Git repo, because that's A Bad Thing.

The idea here is that when people check out the project, they can use their IDE Maven integration (or just mvn command line tools) to download all the dependencies. So we would want to be able to also download this other third party dependency just like all the ones in Maven repo.

I have not been able to come up with an answer to this based on searches -- all solutions seem to be "download it first and create a local repo." Obviously Maven can download from the Internet, since that's how it connects to Maven Central and other repos. So I don't see why it cannot download arbitrary URLs that present packages in recognizable formats.

Answer 1

Long term, the best solution is to use your own artifact repository like Nexus, Artifactory or Archiva. All of these have a manual upload function that you can use to set the groupId, artifactId and version, so you can then refer to the artifact as usual. If you want to go really low tech, I think you can just put some machine's local repository behind an Apache, provided you grant read/write access.

Then you need to add your new repository in the Maven settings.xml file, as described here.

Maven uses the coordinates to navigate the repository (which has a specific layout) and verify artifact checksums for corruption/tampering using metadata files in specific locations of the repo. AFAIK this is similar to other package management systems like APT and RubyGems that use repo manifests and don't allow arbitrary URL downloads.

Skipping the repository manager

If you really don't want or can't use a repository manager, you can always download the artifact and manually install it using the Maven Install Plugin:

mvn install:install-file -Dfile=your-artifact-1.0.jar -DgroupId=org.some.group -DartifactId=your-artifact -Dversion=1.0

However, you'll have to do this on every machine that runs the build, every time that artifact needs to change.