draft-laugstol-apache-maven-repository-rest-applications-08.txt		draft-laugstol-apache-maven-repository-rest-applications-09.txt
	skipping to change at page 1, line 40		skipping to change at page 1, line 40
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on May 14, 2012.		This Internet-Draft will expire on May 14, 2012.
	Table of Contents		Table of Contents
	1. TODOs and Notes . . . . . . . . . . . . . . . . . . . . . . . 2		1. TODOs and Notes . . . . . . . . . . . . . . . . . . . . . . . 2
	1.1. Artifact Repository . . . . . . . . . . . . . . . . . . . 3		1.1. Artifact Repository . . . . . . . . . . . . . . . . . . . 3
	2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3		2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
	2.1. Goals: . . . . . . . . . . . . . . . . . . . . . . . . . . 3		2.1. Goals: . . . . . . . . . . . . . . . . . . . . . . . . . . 4
	2.2. Implementation goals . . . . . . . . . . . . . . . . . . . 4		2.2. Implementation goals . . . . . . . . . . . . . . . . . . . 4
	2.3. Areas explicitly not covered . . . . . . . . . . . . . . . 4		2.3. Areas explicitly not covered . . . . . . . . . . . . . . . 4
	2.4. Deployment scenarios . . . . . . . . . . . . . . . . . . . 4		2.4. Deployment scenarios . . . . . . . . . . . . . . . . . . . 5
	3. Specification . . . . . . . . . . . . . . . . . . . . . . . . 4		3. Specification . . . . . . . . . . . . . . . . . . . . . . . . 5
	3.1. Repository Concepts . . . . . . . . . . . . . . . . . . . 4		3.1. Repository Concepts . . . . . . . . . . . . . . . . . . . 5
	3.2. Media Types . . . . . . . . . . . . . . . . . . . . . . . 5		3.2. Media Types . . . . . . . . . . . . . . . . . . . . . . . 5
	3.3. Operations . . . . . . . . . . . . . . . . . . . . . . . . 5		3.3. Operations . . . . . . . . . . . . . . . . . . . . . . . . 5
	3.4. Uploading Artifacts . . . . . . . . . . . . . . . . . . . 5		3.4. Uploading Artifacts . . . . . . . . . . . . . . . . . . . 6
	3.5. Downloading Artifacts . . . . . . . . . . . . . . . . . . 6		3.5. Downloading Artifacts . . . . . . . . . . . . . . . . . . 6
	3.5.1. Download a single artifact . . . . . . . . . . . . . . 6		3.5.1. Download a single artifact . . . . . . . . . . . . . . 6
	3.5.2. Download a set of artifacts . . . . . . . . . . . . . 6		3.5.2. Download a set of artifacts . . . . . . . . . . . . . 6
	3.6. Searching . . . . . . . . . . . . . . . . . . . . . . . . 6		3.6. Searching . . . . . . . . . . . . . . . . . . . . . . . . 7
	3.7. List Repositories . . . . . . . . . . . . . . . . . . . . 6		3.7. List Repositories . . . . . . . . . . . . . . . . . . . . 7
			3.8. Resolve Repository URN to URL . . . . . . . . . . . . . . 7
	4. Security Aspects . . . . . . . . . . . . . . . . . . . . . . . 6		3.9. Copy/Move Artifact Between Repositories . . . . . . . . . 7
	4.1. Authentication and Authorization . . . . . . . . . . . . . 6		4. Security Aspects . . . . . . . . . . . . . . . . . . . . . . . 7
	5. User-Agent Considerations . . . . . . . . . . . . . . . . . . 6		4.1. Authentication and Authorization . . . . . . . . . . . . . 7
	5.1. Caching . . . . . . . . . . . . . . . . . . . . . . . . . 6		5. User-Agent Considerations . . . . . . . . . . . . . . . . . . 7
	5.2. Multiple links . . . . . . . . . . . . . . . . . . . . . . 7		5.1. Caching . . . . . . . . . . . . . . . . . . . . . . . . . 7
	5.3. Forms . . . . . . . . . . . . . . . . . . . . . . . . . . 7		5.2. Multiple links . . . . . . . . . . . . . . . . . . . . . . 8
	5.4. Server Responses . . . . . . . . . . . . . . . . . . . . . 7		5.3. Forms . . . . . . . . . . . . . . . . . . . . . . . . . . 8
	5.4.1. Single Artifact . . . . . . . . . . . . . . . . . . . 7		5.4. Server Responses . . . . . . . . . . . . . . . . . . . . . 8
	5.4.2. Multiple Artifacts . . . . . . . . . . . . . . . . . . 7		5.4.1. Single Artifact . . . . . . . . . . . . . . . . . . . 8
			5.4.2. Multiple Artifacts . . . . . . . . . . . . . . . . . . 8
	5.4.2.1. text/uri-list . . . . . . . . . . . . . . . . . . 8		5.4.2.1. text/uri-list . . . . . . . . . . . . . . . . . . 8
	5.5. HTTP Binding . . . . . . . . . . . . . . . . . . . . . . . 8		5.5. HTTP Binding . . . . . . . . . . . . . . . . . . . . . . . 8
	6. Appendix: Words and Definitions . . . . . . . . . . . . . . . 8		6. Registrations . . . . . . . . . . . . . . . . . . . . . . . . 9
	7. Security Considerations . . . . . . . . . . . . . . . . . . . 8		6.1. Common Artifact Fields . . . . . . . . . . . . . . . . . . 9
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8		6.2. The Maven Profile . . . . . . . . . . . . . . . . . . . . 9
	8.1. Link Relation: http://maven.apache.org/rel/pom . . . . . . 9		6.2.1. Profile Registration . . . . . . . . . . . . . . . . . 9
	8.2. Link Relation: http://maven.apache.org/rel/md5 . . . . . . 9		6.2.2. Artifact Field Registrations . . . . . . . . . . . . . 9
	8.3. Link Relation: http://maven.apache.org/rel/sha1 . . . . . 9		6.2.3. Artifact Definition . . . . . . . . . . . . . . . . . 9
	8.4. Media Type: text/vnd.maven.pom . . . . . . . . . . . . . . 9		6.3. The Scala Profile . . . . . . . . . . . . . . . . . . . . 10
	8.5. Media Type: text/vnd.maven.md5 . . . . . . . . . . . . . . 9		6.3.1. Artifact Field Registrations . . . . . . . . . . . . . 10
	8.6. Media Type: text/vnd.maven.sha1 . . . . . . . . . . . . . 9		6.4. The Apt Profile . . . . . . . . . . . . . . . . . . . . . 10
	8.7. URN Registration: urn:maven:artifact . . . . . . . . . . . 9		6.4.1. Artifact Field Registrations . . . . . . . . . . . . . 10
	9. Security Considerations . . . . . . . . . . . . . . . . . . . 9		7. Appendix: Words and Definitions . . . . . . . . . . . . . . . 11
	10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 9		8. Security Considerations . . . . . . . . . . . . . . . . . . . 11
	11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9		9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
	11.1. Normative References . . . . . . . . . . . . . . . . . . 9		9.1. Link Relation: http://maven.apache.org/rel/pom . . . . . . 11
	11.2. Informative References . . . . . . . . . . . . . . . . . 10		9.2. Link Relation: http://maven.apache.org/rel/md5 . . . . . . 11
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 10		9.3. Link Relation: http://maven.apache.org/rel/sha1 . . . . . 11
			9.4. Media Type: text/vnd.maven.pom . . . . . . . . . . . . . . 11
			9.5. Media Type: text/vnd.maven.md5 . . . . . . . . . . . . . . 11
			9.6. Media Type: text/vnd.maven.sha1 . . . . . . . . . . . . . 11
			9.7. URN Registration: urn:maven:artifact . . . . . . . . . . . 11
			9.7.1. Version 1 - Maven-Oriented . . . . . . . . . . . . . . 12
			9.7.2. Version 2 - Artifact Repository-Oriented . . . . . . . 12
			9.7.2.1. URN Namespace: Profile . . . . . . . . . . . . . . 12
			9.7.2.2. URN Namespace: Artifact Field . . . . . . . . . . 12
			9.7.2.3. URN Namespace: Search . . . . . . . . . . . . . . 12
			10. Security Considerations . . . . . . . . . . . . . . . . . . . 12
			11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 12
			12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13
			12.1. Normative References . . . . . . . . . . . . . . . . . . 13
			12.2. Informative References . . . . . . . . . . . . . . . . . 13
			Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 13
	1. TODOs and Notes		1. TODOs and Notes
	o How should an artifact be identified?		o How should an artifact be identified?
	* A "Maven Coordinate" HTTP header? Maven-Coordinate:		* A "Maven Coordinate" HTTP header? Maven-Coordinate:
	groupId=com.example, artifactId=example, type=jar,		groupId=com.example, artifactId=example, type=jar,
	classifiers=awesome, version=1.2.3		classifiers=awesome, version=1.2.3
	* A maven URI type? maven://groupId/artifactId/version?		* A maven URI type? maven://groupId/artifactId/version?
	skipping to change at page 6, line 48		skipping to change at page 7, line 18
	3.6. Searching		3.6. Searching
	Servers SHOULD implement conditional controls so it's possible to		Servers SHOULD implement conditional controls so it's possible to
	poll the server regularly.		poll the server regularly.
	TODO: specify how to query for only changes after a certain		TODO: specify how to query for only changes after a certain
	timestamp.		timestamp.
	3.7. List Repositories		3.7. List Repositories
			3.8. Resolve Repository URN to URL
			3.9. Copy/Move Artifact Between Repositories
			TODO: Should it be possible to specify a server to pull from another
			server? Or is "copying/moving" an artifact the same as getting the
			client to download it from repo A, upload it to repo B and delete it
			from repo A?
	4. Security Aspects		4. Security Aspects
	4.1. Authentication and Authorization		4.1. Authentication and Authorization
	Authentication and authorization is generally not specified by this		Authentication and authorization is generally not specified by this
	specification as it is assumed that the transport mechanisms will		specification as it is assumed that the transport mechanisms will
	specify the different options for authentication.		specify the different options for authentication.
	5. User-Agent Considerations		5. User-Agent Considerations
	skipping to change at page 8, line 27		skipping to change at page 9, line 17
	Explain what extra headers can be given with each response for		Explain what extra headers can be given with each response for
	artifacts:		artifacts:
	o Checksums: MD5, SHA-1		o Checksums: MD5, SHA-1
	o Cryptographic signatures, either complete signatures or links to		o Cryptographic signatures, either complete signatures or links to
	signatures		signatures
	o File size		o File size
	6. Appendix: Words and Definitions		6. Registrations
			TODO: Write a template for registrations.
			6.1. Common Artifact Fields
			+--------------+---------------------------------------------------+
			| Field | URN |
			+--------------+---------------------------------------------------+
			| "revision" | "urn:artifact-repository:artifact-field:revision" |
			| "timestamp" | "urn:artifact-repository:artifact- |
			| | field:timestamp" |
			| "version" | "urn:artifact-repository:artifact-field:version" |
			| "media-type" | "urn:artifact-repository:artifact-field:media- |
			| | type" |
			+--------------+---------------------------------------------------+
			6.2. The Maven Profile
			6.2.1. Profile Registration
			o Id: 'maven'
			o URN: urn:artifact-repository:profile:maven
			6.2.2. Artifact Field Registrations
			+--------------+---------------------------------------------------+
			| Field | URN |
			+--------------+---------------------------------------------------+
			| "group-id" | "urn:artifact-repository:artifact-field:group-id" |
			| "artifact- | "urn:artifact-repository:artifact-field:artifact- |
			| id" | id" |
			| "classifier" | "urn:artifact-repository:artifact- |
			| | field:classifier" |
			+--------------+---------------------------------------------------+
			6.2.3. Artifact Definition
			The fields "group-id", "artifact-id", "version", "classifier"
			uniquely identifies a Maven artifact. In addition all artifacts have
			a "media-type" determined by the packaging specified in the POM.
			A Maven artifact can be published many times as long as it is a
			SNAPSHOT version. The timestamp of the deployment should either be
			set to the expanded SNAPSHOT timestmap or it should be set to when
			the request was done. In other words, a "PUT" to
			repo/com/example/foo/1.0-SNAPSHOT/foo-20010203.040506-7.jar
			corresponds to this artifact:
			+----------------+-----------------------+
			| Field | Value |
			+----------------+-----------------------+
			| "group-id" | com.example |
			| "artifact-id" | foo |
			| "version" | 1.0-SNAPSHOT |
			| "media-type" | jar |
			| "timestap" | 2001-02-03T04:05:06Z |
			| "revision" | 7 |
			+----------------+-----------------------+
			If a non-unique snapshot is "PUT" to a repository, a timestamp MUST
			synthesized. A revision MAY be syntheszied.
			6.3. The Scala Profile
			o Id: 'scala'
			o URN: urn:artifact-repository:profile:scala
			The Scala profile builds on top of the "maven" profile, but adds a
			"scala-version" field in addition. A Scala artifact is identified by
			the fields required by the Maven profile and adds the "scala-version"
			field.
			6.3.1. Artifact Field Registrations
			+---------------+--------------------------------------------------+
			| Field | URN |
			+---------------+--------------------------------------------------+
			| "scala- | "urn:artifact-repository:artifact-field:scala- |
			| version" | version" |
			+---------------+--------------------------------------------------+
			6.4. The Apt Profile
			o Id: 'apt'
			o URN: urn:artifact-repository:profile:apt
			6.4.1. Artifact Field Registrations
			TODO: define "architecture".
			7. Appendix: Words and Definitions
	Maven Repository A Maven Repository contain a set of artifacts. Each		Maven Repository A Maven Repository contain a set of artifacts. Each
	artifact is identified by a:		artifact is identified by a:
	* group id		* group id
	* artifact id		* artifact id
	* version		* version
	* type		* type
	* classifier - this is optional		* classifier - this is optional
	See Also (The Maven site at apache)[http://maven.apache.org]		See Also (The Maven site at apache)[http://maven.apache.org]
	7. Security Considerations		8. Security Considerations
	8. IANA Considerations		9. IANA Considerations
	o TODO: Move media types here or this section down.		o TODO: Move media types here or this section down.
	o TODO: Check if there are other checksum relations that are as		o TODO: Check if there are other checksum relations that are as
	useful. It might be possible to reuse something here. Would be		useful. It might be possible to reuse something here. Would be
	make sense to register a "text/checksum" type and assume that all		make sense to register a "text/checksum" type and assume that all
	clients can use content negotiation to find it? Should it be		clients can use content negotiation to find it? Should it be
	registered at all, or should it be assumed that the application		registered at all, or should it be assumed that the application
	always can implement RFC3230?		always can implement RFC3230?
	8.1. Link Relation: http://maven.apache.org/rel/pom		9.1. Link Relation: http://maven.apache.org/rel/pom
	A pointer to a Maven POM file.		A pointer to a Maven POM file.
	TODO: Should probably not be here, a link with rel=describedby,		TODO: Should probably not be here, a link with rel=describedby,
	contentType=text/vnd.maven.pom is probably fine.		contentType=text/vnd.maven.pom is probably fine.
	8.2. Link Relation: http://maven.apache.org/rel/md5		9.2. Link Relation: http://maven.apache.org/rel/md5
	8.3. Link Relation: http://maven.apache.org/rel/sha1
	8.4. Media Type: text/vnd.maven.pom		9.3. Link Relation: http://maven.apache.org/rel/sha1
	8.5. Media Type: text/vnd.maven.md5		9.4. Media Type: text/vnd.maven.pom
	8.6. Media Type: text/vnd.maven.sha1		9.5. Media Type: text/vnd.maven.md5
	8.7. URN Registration: urn:maven:artifact		9.6. Media Type: text/vnd.maven.sha1
	Should it be "urn:maven:artifact", "urn:maven" or "urn:artifact-		9.7. URN Registration: urn:maven:artifact
	repository".
	Use template in http://tools.ietf.org/html/rfc3406#appendix-A		Use template in http://tools.ietf.org/html/rfc3406#appendix-A
	Creating an informal registration seems the right way to do as long		Creating an informal registration seems the right way to do as long
	as this document doesn't become an RFC.		as this document doesn't become an RFC.
			9.7.1. Version 1 - Maven-Oriented
			Should it be "urn:maven:artifact", "urn:maven" or "urn:artifact-
			repository".
			9.7.2. Version 2 - Artifact Repository-Oriented
	URN notes:		URN notes:
	o A single artifact: "urn:artifact-repository:artifact:<attributes>"		o A single artifact: "urn:artifact-repository:artifact:<attributes>"
	o A search: "urn:artifact-repository:search:<attributes>"		o A search: "urn:artifact-repository:search:<attributes>" (used by
			feeds etc).
	9. Security Considerations		o A repository: "urn:artifact-repository:repository:<repository
			id>". If a "repository" field is a URIthis is how an URN should
			look like. A user-agent will have to somehow resolve the URN to
			an URL if it has to actually interact with the repository.
	10. Acknowledgments		o A 'profile' definition: "urn:artifact-repository:profile".
			Identified profiles:
	11. References		* "maven" - A Maven repository
	11.1. Normative References		* "scala" - A repository of JAR files for Scala projects.
			Extends the "maven" profile with a "scala version" field.
			* "sbt" - A repository of JAR files for SBT plugins. Extends the
			"scala" profile with a "sbt version" field.
			* "apt" - A repository with .deb files for Debian/Ubuntu etc.
			* "opencsw" or "pkg" - a repository with .pkg files for Solaris
			(similar to "apt").
			9.7.2.1. URN Namespace: Profile
			Purpose: Identify registered artifact profiles. Prefix: "urn
			:artifact-repository:profile"
			9.7.2.2. URN Namespace: Artifact Field
			Purpose: Idenfity possible fields on artifacts. Prefix: "urn
			:artifact-repository:field"
			9.7.2.3. URN Namespace: Search
			Purpose: Idenfity searches Prefix: "urn:artifact-repository:field"
			10. Security Considerations
			11. Acknowledgments
			12. References
			12.1. Normative References
	[RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", RFC		[RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", RFC
	1864, October 1995.		1864, October 1995.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	[RFC2483] Mealling, M. and R. Daniel, "URI Resolution Services		[RFC2483] Mealling, M. and R. Daniel, "URI Resolution Services
	Necessary for URN Resolution", RFC 2483, January 1999.		Necessary for URN Resolution", RFC 2483, January 1999.
	skipping to change at page 10, line 26		skipping to change at page 13, line 42
	2010.		2010.
	[RFC6249] Bryan, A., McNab, N., Tsujikawa, T., Poeml, P. and H.		[RFC6249] Bryan, A., McNab, N., Tsujikawa, T., Poeml, P. and H.
	Nordstrom, "Metalink/HTTP: Mirrors and Hashes", RFC 6249,		Nordstrom, "Metalink/HTTP: Mirrors and Hashes", RFC 6249,
	June 2011.		June 2011.
	[RFC6266] Reschke, J., "Use of the Content-Disposition Header Field		[RFC6266] Reschke, J., "Use of the Content-Disposition Header Field
	in the Hypertext Transfer Protocol (HTTP)", RFC 6266, June		in the Hypertext Transfer Protocol (HTTP)", RFC 6266, June
	2011.		2011.
	11.2. Informative References		12.2. Informative References
	[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,		[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
	April 1992.		April 1992.
	[RFC3174] Eastlake, D. and P. Jones, "US Secure Hash Algorithm 1		[RFC3174] Eastlake, D. and P. Jones, "US Secure Hash Algorithm 1
	(SHA1)", RFC 3174, September 2001.		(SHA1)", RFC 3174, September 2001.
	[RFC3406] Daigle, L., van Gulik, D., Iannella, R. and P. Faltstrom,		[RFC3406] Daigle, L., van Gulik, D., Iannella, R. and P. Faltstrom,
	"Uniform Resource Names (URN) Namespace Definition		"Uniform Resource Names (URN) Namespace Definition
	Mechanisms", BCP 66, RFC 3406, October 2002.		Mechanisms", BCP 66, RFC 3406, October 2002.
End of changes. 23 change blocks.
	53 lines changed or deleted		213 lines changed or added
This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/