[HELP] Compatibility with 3.78?

[eirisdg]

Hi.

I've seen the releases notes of 3.78 and this is the first point:

Breaking Change for Custom Plugins: Nexus Repository Migrates to Spring Boot Architecture
This release marks a significant shift in Nexus Repository's architecture, migrating from Apache Karaf and OSGi to the Spring Framework. This transition modernizes the underlying technology stack, aligning with industry best practices and enabling future innovation.

Sonatype Nexus Repository is now packaged as a single "uber-jar," simplifying deployment and dependency management. Nexus Repository installers now include ARM-compatible JREs for Unix and macOS platforms in addition to the x86-64 versions. Windows installers will continue to be x86-64 only.

https://help.sonatype.com/en/sonatype-nexus-repository-3-78-0-release-notes.html

Do you know if the plugin wil still work?

[tumbl3w33d]

Woah Sonatype, gimme a break… The plugin is not even 12 months old and I already went from ExtJS to React (okay, my fault, could have seen that it's in transition), from OrientDB to H2 and now this? Yey.

I assume it will not just work out of the box but need yet another major rework. There is no doubt about that I will do it, I just won't make promises how fast. But my company also needs this upgrade for our internal use as we update Nexus on a weekly basis and this is a blocker, so it will happen sooner than later. Good thing is that at least this time I am quite familiar with where we are going (Spring).

[eirisdg]

I'm glad to hear that it will continue to receive maintenance from you. My company also depends on this plugin, so we will be keeping an eye on updates.

Thanks for your work!

[Rohmilchkaese]

Thanks @tumbl3w33d i back @eirisdg ! Very much dependent on your work. Appreciate it

[tumbl3w33d]

The current situation is described here: https://community.sonatype.com/t/custom-plugins-still-possible-starting-with-3-78/14589

[tumbl3w33d]

Since I was forced into buying a pro license due to their sudden shift in version tiers, I was able to create a high priority support ticket to finally get an answer from Sonatype after they ignored my public question in the community forum.

You won't like the answer. The summary:

As of now, there isn't a straightforward way to load custom plugins in the new architecture.

Their advice is to watch how the community handles that.

For now all I can do is wait for something to happen, but I'm afraid that's not happening and to be honest, to me this looks like a deliberate choice in disguise – especially given their lack of response to my public thread. Sorry for you guys who rely on this. One way to deal with it is buying the pro version, using their SAML and putting a bridge in between this and your OIDC provider.

[eirisdg]

I've been following the thread, and I think this is really bad news. I don't know to what extent it's legal to release an update for an open-source product, publish its new terms, and include in those terms that plugins will remain compatible—only for them to technically become incompatible just one version later... It's frustrating.

In my case, we migrated from Artifactory to Nexus a month ago, thanks to the support of plugins like yours, as it allows us to have OIDC in the application without having to pay a fortune. Unfortunately, we don't use Nexus enough to justify a corporate purchase of a Pro license, so we'll probably stick with this version forever.

Either way, I'll be keeping an eye on this in the medium term. Just as they were forced to bring back a community version before, I hope the same happens this time (hope is not lost).

I would also ask that, even if the plugin cannot be updated for future Nexus versions, it remains maintained for version 3.77—at least to fix and improve pending issues.

Thanks for everything!

[tumbl3w33d]

I read your posting a while ago and somehow missed your question about further maintenance. I'm fine with keeping this alive in terms of security fixes or if some issue that affects several people comes up. You are probably referring to your issue #26 and I want to be honest about that I am not too motivated to work on that one and will explain why. I have no usage data on which I could base my assumption other than no one else showing up in that issue. I would say, it is a rare case anyone would not pass groups from the IdP to nexus. If it is really urgent for your scenario, I might find time at some point, however, time is the most limited resource we have, as we all know, which brings me to the second and more important point:

I don't think I want to stay with Sonatype's solution longer than necessary after this recent move. There might be a mindset shift on the way, but I would not want to rely on it, especially based on their poor communication (not replying to my forum posting for almost a month). I did not expect an immediate solution, just transparency like "that was an oopsie, we will figure it out". The whole story revealed that the plugin community is not a relevant factor in their planning whatsoever.

Right now I'm fiddling with an own solution to replace Nexus entirely. Admittedly, that's a bigger endeavor than this plugin was and maybe the world will never see it, but then I know I tried. I'm convinced I can do better at least in terms of customer satisfaction and security aspects like OIDC authentication will not come with a price tag, making me end up on https://sso.tax/.

[eirisdg]

I wasn't referring to the issue I created, as it only affects the initial installation, and once installed everything works perfectly, so I don't consider it a priority. Instead, I was referring to issues that might arise regarding security.

I understand your position, and I share it. Unfortunately, there aren't many SSO alternatives that allow you to do what Nexus does. I've found a couple of projects, but they seem very, very immature.

Anyway, I appreciate your attention and I hope you're able to eventually share that alternative solution of your own.