Eclipse-owned repository for Temurin artifacts
Summary
As discussed during a previous meeting with Mikael and Fred, we would like to be able to have a second repository to host our final "release" artifacts. My understanding is that the facilities are available to do this via a Nexus V2 repository and/or scp access to a server somewhere.
Please provide us with a suitable repository for this. If full capacity data is required first please let me know, but as a guideline we currently do four update releases four times a year, plus two new releases twice a year. A release would contain the artifacts listed in this link as an example: https://github.com/adoptium/temurin17-binaries/releases/tag/jdk-17.0.5%2B8
This is being driven by SSDF PS3.1 "Securely archive the necessary files and supporting data to be retained for each software release". Our primary distribution mechanism is github but we would prefer something "closer to home" as a secondary source.
Priority
- Urgent
- High
- Medium
- Low
Severity
- Blocker
- Major
- Normal
- Low
Impact
The impact of this would be not meeting the requirements of the SSDF framework, and not having a backup of all of our releases in the case of a problem/outage/change of conditions at GitHub
Activity
added team:infra team:releng labels
The primary purpose of this is as an "internal" backup of production artifacts. On that basis either would be fine and we have no current requirement to distribute externally from it at present (and certainly not as a primary mechanism On that basis, and the fact we don't really require the distributed capabilities, the Nexus might be better, but if there are cost/space implications that means ssh is preferable I'd be ok with that too. If there are any differences in terms of security/access controls on each (We'd want this to be generally read-only) then that might influce the decision. Feel free to contact me out of this issue if you want to discuss further.
Having a look at our latest releases it looks like that total space used for each OpenJDK version is as follows (data in brackets is a pipeline reference for my own use!)
- Around 6.5Gb for a JDK19 release (237+W64)
- 3.5Gb for a JDK8 release (2258+2259+2269)
- Around 7Gb for a JDK11 release (2121+2122)
- Around 6Gb for a JDK17 release (539)
So that's a total of around 25Gb (with a small amount of contingency) for each quarterly release which we do, plus two new major releases a year which we should expect to be around 7Gb. Total of around 115Gb/year.
The storage requirements are more than reasonable. I would like to suggest SCP to download.eclipse.org for the simple matter that the files on download.e.o will be replicated worldwide to our mirror network. This means that, in the unlikely event we do need to assume distribution, we can handle it. With our single instance Nexus, we don't stand a chance.
added IT-prioritymedium IT-severitynormal labels
added Awaiting Feedback label
added statetodo label
removed Awaiting Feedback label
assigned to @fgurr
https://download.eclipse.org/temurin-compliance/ is already set up.
Instructions how to deploy artifacts from a Jenkins job (running on a EF build-cluster based build agent) can be found here: https://wiki.eclipse.org/Jenkins#How_do_I_deploy_artifacts_to_download.eclipse.org.3F
Please test it and re-open if anything is missing or unclear.
removed statetodo label
mentioned in issue #2496 (closed)
