Maven repositories

Maven repositories serve the Maven 2 layout that mvn, Gradle, sbt, Ivy and every other Maven client use. Hosted repositories take deploys; proxy repositories cache Maven Central or another Maven repository.

1. Set up Maven

Put an API token in ~/.m2/settings.xml as the password of a server, then point <repositories> (to download) or <distributionManagement> (to deploy) at the repository with the same id:

<server>
  <id>depotex</id>
  <username>me</username>
  <password>${env.DEPOTEX_TOKEN}</password>
</server>

<repositories>
  <repository>
    <id>depotex</id>
    <url>https://depotex.example.com/repository/my-space/maven/</url>
  </repository>
</repositories>

<distributionManagement>
  <repository>
    <id>depotex</id>
    <url>https://depotex.example.com/repository/my-space/releases/</url>
  </repository>
  <snapshotRepository>
    <id>depotex</id>
    <url>https://depotex.example.com/repository/my-space/snapshots/</url>
  </snapshotRepository>
</distributionManagement>

To send every download through Depotex, add a mirror for * to settings.xml pointing at a proxy repository of Maven Central.

With a group as the space's default for Maven, one address does everything: https://depotex.example.com/repository/my-space/maven/ downloads from the group's members in order (your releases and snapshots, then Maven Central) and takes deploys, which go to the releases or snapshots repository by the group's write rules. Use it for <repositories>, both <distributionManagement> entries, and the * mirror.

2. Set up Gradle

repositories {
    maven {
        url = uri("https://depotex.example.com/repository/my-space/maven/")
        credentials {
            username = System.getenv("USER")
            password = System.getenv("DEPOTEX_TOKEN")
        }
    }
}

Publish with the maven-publish plugin and the same repositories { maven { … } } block under publishing.

3. Download and deploy

mvn deploy -DaltDeploymentRepository=depotex::https://depotex.example.com/repository/my-space/releases
mvn dependency:get -DremoteRepositories=https://depotex.example.com/repository/my-space/maven/ -Dartifact=com.acme:app:1.0

• Versions: each groupId:artifactId version is one version in Depotex (the Versions tab, cleanup policies, quotas). All builds of a snapshot (1.0-SNAPSHOT) are one version.
• Version policy: a Release repository refuses snapshot versions, a Snapshot repository refuses releases, Mixed takes both. Proxy repositories apply it too: a release proxy doesn't fetch snapshots.
• maven-metadata.xml of hosted repositories is generated from what they hold: the versions in Maven's order, with the latest and the latest release, and for snapshots the newest build of each file. Blocked versions are left out, and the metadata's checksum files match.
• Checksum files that mvn uploads next to each file are checked against it; a mismatch is refused. .sha1, .md5, .sha256 and .sha512 downloads are always answered.
• Publishing once (Allow once) stops a file from being overwritten, but metadata is rewritten freely, as every deploy needs.
• Strict layout refuses paths outside the Maven layout (group/artifact/version/artifact-version[-classifier].ext); permissive stores them like raw files.

4. Proxy repositories

Add an upstream with the Maven Central preset (https://repo1.maven.org/maven2) or your mirror's address, allow it for the space, then create a proxy repository with it. Files are fetched on first request, checked against the upstream's checksums and kept; see Proxy repositories for cache settings. Blocked versions are also left out of proxied maven-metadata.xml.

5. In the artifact browser

Maven packages show as group folders, then artifacts and their versions. The Overview shows the POM (name, description, packaging, parent, licenses, source code, organization, developers), Dependencies lists them by scope with properties filled in, and SBOMs published as classifiers (-cyclonedx.json, .spdx.json) and .asc signatures appear under Security.

6. Limits

• Plugin-prefix metadata (group/maven-metadata.xml) is served as uploaded, not generated.
• No archetype catalog and no Maven Indexer export.
• A proxy serves its upstream's maven-metadata.xml as is, apart from leaving out blocked versions.
• Generated metadata lists at most 10,000 versions per artifact.