Java libraries migration guide#3506
Conversation
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
✅ Deploy Preview for ornate-narwhal-088216 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
|
||
| ```bash | ||
| rm ~/.m2/repository/commons-io/commons-io/2.13.0/commons-io-2.13.0.jar | ||
| mvn dependency:resolve |
There was a problem hiding this comment.
That resolves a project's dependencies. If you want to resolve the specific JAR you need to use dependency:get or some other tool.
There was a problem hiding this comment.
In this case mvn dependency:get -Dartifact=commons-io:commons-io:2.13.0 but it might be best to find an example that is newer so artifactId and groupId are not that same.. thats a very old antipattern that is no longer allowed for new artifacts.
There was a problem hiding this comment.
I updated this section to use dependency:get
SharpRake
left a comment
SharpRake
left a comment
There was a problem hiding this comment.
Some minor fixes from me, it's overall looking good!
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
|
|
||
| ```shell | ||
| cd your-project | ||
| mvn install |
There was a problem hiding this comment.
Since you use the Gradle wrapper.. also use the maven wrapper in the examples
There was a problem hiding this comment.
Or change Gradle since bazel is directly invoked as well..
|
|
||
| {{% tab title="Maven" %}} | ||
|
|
||
| Maven repository configuration is split across two files: repository URLs go in your project's `pom.xml`, and credentials go in `~/.m2/settings.xml`. The `server` IDs in `settings.xml` must match the `repository` IDs in `pom.xml` — Maven pairs them automatically by ID when resolving credentials. |
There was a problem hiding this comment.
Sorry.. not sure how you came to that. Adding the repos to the pom is a known bad pattern. It should all stay in the settings file. The only thing is if you want to use it only locally in a project, the convention is to have it located in the .mvn folder in the project and use -s in all calls. See https://github.com/chainguard-demo/chainguard-libraries-java/tree/main/cve-2024-38819
|
|
||
| <servers> | ||
| <server> | ||
| <id>repo-manager</id> |
There was a problem hiding this comment.
this must be nexus .. see comment earlier
There was a problem hiding this comment.
I updated the paragraph before the config. It now links to the GitHub examples for repo manager settings and says to use environment variables for credentials when possible
| Then verify using the full path. For example: | ||
|
|
||
| ```bash | ||
| chainctl libraries verify ~/Library/Caches/bazel/_bazel_example/c22a55500fa8462e9bf6b663d5366abd/external/rules_jvm_external++maven+maven/v1/https/45a0c61ea6fd977f050c5fb9ac06a69eed764595/1f4231148aeda823%40libraries.cgr.dev/java/com/fasterxml/jackson/core/jackson-databind/2.9.10/jackson-databind-2.9.10.jar |
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
Signed-off-by: s-stumbo <sally.stumbo@chainguard.dev>
mosabua
left a comment
mosabua
left a comment
There was a problem hiding this comment.
Lgtm now. Ship it when you are ready.
4 participants
[ ] Check if this is a typo or other quick fix and ignore the rest :)
Type of change
New guide on migrating to Java libraries
What should this PR do?
Explain how to migrate an existing Java project to use Chainguard libraries
Why are we making this change?
Reduce friction in onboarding
What are the acceptance criteria?
The instructions should be accurate and clear
How should this PR be tested?
Any documentation published to Chainguard Academy is reviewed carefully for accuracy. GUI procedures, API commands, and CLI code snippets in a draft are run and tested thoroughly — by both the author and the reviewer — to confirm they work exactly as written. This helps ensure that readers can follow along and get the same results. See the
edurepo's README.Create a basic Java app with some dependencies, then follow the migration guide to switch the libraries to Chainguard.