The Secret Life of Maven Central

on YouTube ↗33m

" summary

Maven Central serves about 10 billion weekly requests and Sonatype runs publication through Nexus Repository Manager, orchestrates builds with Jenkins and pushes artifacts to Fastly + S3 as CDN/origin. The Bintray shutdown in Feb 2021 spikes bandwidth ~22–23% and forces manual handling of roughly 700 migrated projects over three months; automation for namespace claims is throttled to prevent hijack. Response to Log4Shell requires rapid Log4j upgrades and multi-day incident work, and a mid‑May rollout sends SBOM emails to publishers with vulnerability summaries.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:57Definitions
3. 4:04Maven Central
4. 8:17Highlevel architecture
5. 12:32Maven Central in 2021
6. 15:32BEA Shutdown
7. 22:17Sbomb
8. 23:46End of 2021
9. 26:07Future direction
10. 27:53Staging server
11. 28:46How to help

" related talks

• 53mThe Secret Life of Maven CentralJamie Coleman · JCON Europe 2023
• 20mThe Secret Life of Maven CentralJamie Coleman · Great International Developer Summit 2023
• 29mThe Secret Life of Maven centralSteve Poole · EclipseCon 2022
• 38mThe secret life of Maven CentralJamie Coleman · J-Fall 2023
• 31mOpen Source Supply Chain Threat Landscape - A Moving TargetBrian Fox · Open Source in Finance Forum New York 2022
• 41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving TargetBrian Fox · SupplyChainSecurityCon at Open Source Summit North America 2022
• 37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes FromBrian Fox, Stephen Magill · DevOps Enterprise Summit 2022
• 18mSecuring Open Source in Nomura’s Software Supply ChainNick Wadge · DevOps Enterprise Summit London 2018