Oracle AIDP Spark — private Maven repository or signed download

1. Release approval and validation

1. Verify written authorization for the customer, DataAI version, Oracle Spark environments, term, users/workloads, and commercial rights.
2. Confirm the target Spark/Scala/Java baseline and decide whether the customer will resolve Maven coordinates or receive a ZIP/JAR bundle.
3. Obtain the authorized production package and compare every distributed file with ARTIFACTS.sha256.
4. Record artifact coordinates or storage paths, SHA-256 values, customer, approver, license/order reference, publication date, and expiration/renewal date.

2A. Publish to a private Maven repository

1. Create or select a production release repository that requires authentication and does not permit anonymous download.
2. Create a publisher identity with deploy rights and customer/runtime groups with read-only rights. Store credentials in approved secret managers.
3. Publish the required DataAI modules under the approved group IDs, artifact IDs, and immutable 1.0.0 version. Publish dependency metadata/POMs together with JARs.
4. Confirm the repository is configured against redeploying a released version. Never upload different bytes under an existing version.
5. Use a clean Maven cache and a read-only customer test identity to resolve all approved coordinates. Compare downloaded hashes and run the DataAI smoke test.
6. Provide the customer only the repository URL, approved coordinates/version, secure credential-enrollment method, checksum record, production guides, and entitlement reference.

2B. Fulfill by private OCI artifact or signed download

1. Create a private OCI Artifact Registry generic repository or private Object Storage bucket in the approved compartment and region.
2. Apply least-privilege IAM policies to the Yanbor publisher and authorized customer/download identities. Keep public access disabled.
3. For Artifact Registry, upload the immutable ZIP or JAR using a meaningful artifact path and version. The OCI CLI supports oci artifacts generic artifact upload-by-path --repository-id <repo-ocid> --artifact-path <path> --artifact-version 1.0.0 --content-body <file>.
4. For Object Storage, upload the ZIP and checksum as separate objects, keep the bucket private, and create a customer-specific pre-authenticated request only when allowed by Yanbor and customer policy.
5. Set the narrowest usable scope and expiration. A pre-authenticated request acts like a bearer URL, so transmit it only through the authorized customer channel and revoke it after fulfillment or at expiration.
6. Test the exact customer path from a clean session, download both files, recompute SHA-256, and confirm the archive extracts without error.

3. Customer handoff and acceptance

1. Give the customer the correct Oracle production installation guide, usage guide, supported runtime baseline, list of required/optional modules, license certificate/order reference, and support contact.
2. Require the customer to store artifacts in its approved private location, keep Oracle/Spark platform libraries provided by the platform, and inject repository/storage credentials from its secret facility.
3. Have the customer attach the JARs through the Oracle Spark platform's supported library mechanism or spark-submit --jars, then run a fictional/synthetic-data acceptance job.
4. Record the clean retrieval, hash match, smoke-test result, runtime version, output location, and customer acceptance contact.

4. Renewal and updates

• Issue a new semantic version for changes; do not replace an immutable release.
• Revoke repository permission and pre-authenticated requests when authorization expires.
• Repeat compatibility and acceptance tests after Oracle platform runtime changes.

Official references

• Oracle: Artifact Registry overview
• Oracle: create an artifact repository
• Oracle: upload a generic artifact
• Oracle: Object Storage pre-authenticated requests

Back to DataAI ETL Markets