Nexus has been implemented in the company a couple of months ago. The side effect is that credentials are required to download artifacts and thus everybody that compiles the code requires a password.
The question is how to improve the security. Imagine that somebody leaves the company then the password has to be changes or somebody has leaked the password.
One possibility is to use Hashicorp Vault, but there seems to be no nexus plugin that integrates this functionality.
Basically, the acceptance criteria are:
- it should be possible to monitor who accessed nexus and what artifacts were downloaded (audit logging)
- there should be a service that restricts access to nexus
- the password should be changed periodically without causing any burden, e.g. password has to be sent to engineers and they have to change their systems
How does the gradle configuration look like?
authentication(userName: mavenUser, password: mavenPassword)