The Secret Life of Maven central
summary
Maven Central serves over 10 billion requests a week and hosts roughly 496 billion downloads, backing a repo built on Fastly, large S3 storage, Solr indexing and Jenkins jobs. Publishers must pass domain ownership checks so arbitrary malware uploads are rare; uploads flagged as active malware are removed while vulnerable but not malicious versions remain to avoid breaking consumers. New features include BOM Doctor for producing SBOMs and planned Sigstore-style signing and richer project safety metadata.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:55What is Maven Central
- 7:12Maven Central’s safety role
- 12:12Detecting vulnerabilities
- 15:00Supply chain attacks rise
- 18:11Future of Maven Central
- 21:01Developer tools
- 24:15Community input
- 26:45Q&A
related talks
20mThe Secret Life of Maven Central
53mThe Secret Life of Maven Central
38mThe secret life of Maven Central
33mThe Secret Life of Maven Central
31mOpen Source Supply Chain Threat Landscape - A Moving Target
06mLightning Talk – Back to a Maven [Repository]
16mMaven - Taming the Beast
58mThe Current State of Apache Maven 4