cloudrepo-migrate (early access)

Moves a Nexus 2 server's repositories into CloudRepo and verifies every file.

• Maven: every file of each hosted Maven repository, POMs and checksum files included.
• npm: the latest dist-tag of each package in each hosted npm repository (older versions are counted in the report, not moved).
• Skipped with a reason: proxy repositories (create a CloudRepo proxy instead), group repositories (create a CloudRepo group of the moved ones), virtual repositories, other formats, and files Nexus generates itself (.index, .meta, the root archetype-catalog.xml).

Every file is read back from CloudRepo after upload and its sha1 and sha256 compared with the source's bytes. A checksum file the source carries (X.sha1, X.sha256, X.sha512, X.md5) must name the digest of X. Any mismatch fails the run and names the file.

Install

pipx install cloudrepo-migrate

That installs it from pypi.org and puts cloudrepo-migrate on the PATH (pip install cloudrepo-migrate in a virtual environment works too).

It is one file, Python 3.8 or later, with no dependencies, so copying cloudrepo_migrate.py to a machine that can reach the Nexus server and running python3 cloudrepo_migrate.py --help works too.

Run

Create each target repository in CloudRepo first (same name as the Nexus repository, or map it with --repo SOURCE=TARGET) at https://admin.cloudrepo.io/repositories/create, and a repository token that can write them.

export NEXUS_USERNAME=deployer NEXUS_PASSWORD=...   # leave both unset for anonymous read
export CLOUDREPO_TOKEN=...
cloudrepo-migrate nexus2 --nexus-url https://nexus.example.com/nexus --org acme --dry-run
cloudrepo-migrate nexus2 --nexus-url https://nexus.example.com/nexus --org acme --report-json report.json

With the environment set, nothing prompts. On a terminal with a credential missing it asks for it.

Resume: run the same command again. A file CloudRepo already holds with the same bytes is counted as already present and not uploaded again; a 409 on a release CloudRepo already holds counts as moved once its bytes match.

Exit codes: 0 everything moved and verified; 1 at least one file failed (every failure is listed with its path; re-run to resume); 2 a usage or preflight problem, such as a missing target repository or a refused token (nothing moved).

Credentials

• Read only from the environment or a terminal prompt: never from the command line, never printed, never written to the report.
• The Nexus login is sent only to --nexus-url, the CloudRepo token only to CloudRepo.
• Redirects are never followed, and no URL is taken from a server's answer (a packument's dist.tarball contributes only its file name), so neither credential can be steered to another host.
• CloudRepo must be https (plain http only to localhost). A plain-http Nexus gets a warning.