DevOps AcademyLearn the delivery system
Chapter 32Lesson 04~195 minutes

Artifact Repositories, Nexus/Artifactory Integration, Package Promotion, Build Metadata, and Release Traceability: Diagnostics, Failure Modes, Security, and Performance

Preserve Jenkins and repository evidence, identify the failing transition, then repair the narrowest layer instead of overwriting, deleting or rebuilding until green.

Diagnostics401/403/409Overwrite protectionCredentialsTraceabilityPerformance

Learning objectives

  • Diagnose from producer build through upload, acceptance, retrieval and promotion.
  • Separate authentication, authorization, coordinate conflict and repository policy failures.
  • Prove when a “successful” publication selected the wrong bytes or path.
  • Reject destructive troubleshooting that erases release evidence.
  • Measure repository latency and artifact volume before tuning Jenkins.

1. Evidence-first diagnostic order

  1. Preserve job full name, build number/URL/cause, queue ID and source SHA.
  2. Record Jenkins core/Java/plugin/tool baseline and first failing console lines.
  3. Confirm repository server/key and exact coordinates.
  4. Record producer artifact path, size and SHA-256.
  5. Interpret client/HTTP response.
  6. Retrieve by exact coordinate and recompute repository digest.
  7. Compare build metadata with Jenkins job/build/source identity.
  8. Inspect promotion source/target/actor and before/after digest.
  9. Change only the incorrect permission, path, policy or client configuration.
  10. Retry only if the operation is safe and idempotent for the intended coordinate.

2. Failure map

Symptom Likely layer Preserve first
401/403 Authentication/authorization Credential ID/scope, endpoint, HTTP status/body; never secret value
409 / overwrite rejection Coordinate/redeploy policy Existing object digest/metadata and new producer digest
Upload exits 0 but consumer fails Wrong path/repository/format metadata Exact URL/path, response, browse/API result
Promotion digest changes Rebuild/transformation/wrong object Candidate/release digests and promotion request
Cannot trace package to source Missing/mismatched build metadata Job/build/source SHA and repository metadata/Build-Info
Publishing is slow Network/repository I/O/artifact volume Transfer bytes/time, service latency, queue wait

3. Broken: overwrite the release version

# BROKEN
VERSION=1.0.0
cp dist/widget.txt "lab-repo/releases/widget-$VERSION.txt"

The repair is not “delete first.” Use unique candidates and a non-redeploy release policy. If a release coordinate exists, preserve and compare its digest/metadata.

4. Broken: rebuild during promotion

# BROKEN
./gradlew clean build
curl --upload-file build/libs/app.jar "$RELEASE_REPO/app-1.0.0.jar"

Dependency/tool/environment drift can produce a different digest. Promotion should select the verified candidate object, not compile again.

5. Broken: use repository administrator credentials

Broad credentials make permission errors disappear by removing the boundary. Instead, determine the exact operation and grant the narrow repository privilege. Store secrets in Jenkins Credentials or an external provider and avoid shell tracing/generated credential files.

6. Broken: delete “latest”

# BROKEN and ambiguous
rm -rf "$(find lab-repo/releases -mindepth 1 -type d | sort | tail -1)"

Ordering can select the wrong release. Cleanup must use the exact lab coordinate created by this run; production cleanup should be policy-driven and protect released objects.

7. Interpret HTTP status by layer

Status Meaning Action
2xx HTTP request accepted Still query/retrieve and verify exact object/digest.
401 Authentication invalid/missing Check credential binding and endpoint.
403 Authenticated but unauthorized Check exact privilege/scope; do not jump to admin.
404 Wrong endpoint/repository/path or policy-hiding Verify repository identity and coordinate.
409 Conflict/redeploy/policy Preserve existing object and stop before overwrite.
5xx Server/service failure Preserve response; retry only when operation is safe/idempotent.

8. Performance: measure first

Record artifact count/size, upload/download throughput, repository latency, checksum time and Jenkins queue wait. More executors or parallel uploads can worsen repository saturation. Do not skip digest verification merely to shave seconds off a release boundary.

9. Digest mismatch incident

  1. Freeze promotion for the exact coordinate.
  2. Preserve candidate/release metadata, Jenkins build/source and both digests.
  3. Do not rerun or overwrite either object.
  4. Check wrong-object selection, transformation or rebuild.
  5. Audit promotion actor/credential and repository logs.
  6. Publish a new uniquely identified candidate if new bytes are required.
Next

Checkpoint: prove traceability

Lesson 5 requires one candidate, one release, digest continuity, build metadata, an overwrite-negative test and a cleanup guard.

Knowledge check

Answer before revealing the explanation.

1. A PUT returns HTTP 201. Is the release proven correct?

2. Why preserve a 409 instead of deleting the conflicting object?

3. Candidate and release digest differ after a copy-only promotion. Which layer is suspect?

4. Why can more Jenkins executors make publishing slower?

Official references and version notes

Repository formats, Jenkins plugins, credentials models and promotion APIs evolve; prefer current primary documentation.

Keep the academy open

Support free, practical DevOps education.

Every lesson is designed to remain readable in a browser, downloadable from GitHub, and usable without a paid learning platform. Contributions help expand and maintain the curriculum.

Ethereum / ERC-20
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0Send only Ethereum/ERC-20 compatible assets to this address.