Formats and running it
A Maven repository proxy for mvn, Gradle and sbt
Switch on Maven repository under Settings, Registries, Package types, add Maven Central as an upstream, and the box answers /maven/ for mvn, Gradle and sbt.
Mirror everything through it in ~/.m2/settings.xml. The server id has to match the mirror id, which is how Maven knows which password to send:
<settings>
<servers>
<server><id>company</id><username>your-user-name</username><password>${env.REPO_TOKEN}</password></server>
</servers>
<mirrors>
<mirror><id>company</id><mirrorOf>*</mirrorOf><url>https://packages.example.com/maven/</url></mirror>
</mirrors>
</settings>Gradle takes the same address in a maven { url ... } block with credentials, under repositories and under pluginManagement so plugins come through too.
The upstream is https://repo1.maven.org/maven2, or a Nexus or Artifactory repository with a user name and password. Rules are written on groupId:artifactId, like org.apache.logging.log4j:log4j-core, or org.apache.maven.plugins:* for a whole group. A bare version is exactly that version, and Maven ranges like [2.17,2.18) work too.
maven-metadata.xml is rebuilt from the versions the rules allow, so a range resolves to an allowed version, and its checksums are worked out from the bytes this box sends. Every other file is streamed in, hashed, checked against the .sha1 the repository publishes, and refused if it does not match. A path has to name a file of its own artifact and version, so nothing can reach outside a package. mvn and Gradle print the reason for a refusal in their error line, and the refusal opens a request.
What applies, and what does not
Rules, the kill switch, quarantine, malware scanning (the OSV known malicious check included), license policy from the pom, requests, auto approve and safe version resolution all apply. Advisories come from OSV's Maven feed. Cooling off works from publish times, which are read for the newest few versions of a package.
Honest limits: only releases are served. Snapshots are not, so keep your own snapshots somewhere else. A milestone or release candidate counts as an ordinary version, because poms pin them. mvn deploy is not taken, so this is a proxy and not a place to publish. mvn fetches its plugins through the same mirror, so they need allow rules too; one build in audit only mode lists them. Typosquat checks, provenance checks and the tree walk are not offered for Maven.
In short
- mvn, Gradle and sbt through one mirror address
- Maven Central, Nexus or Artifactory as the upstream
- Rules on
groupId:artifactIdwith Maven ranges - Every file checked against the published
.sha1 - Metadata rebuilt from the versions the rules allow
- Releases only: no snapshots, no
mvn deploy
In the documentation
- Set up Maven Developer Guide
- Set up Gradle Developer Guide
- Version ranges and releases Developer Guide
- Maven repositories Administrator Guide
Goes well with
- Private NuGet feed and proxy dotnet and Visual Studio through nuget.org or a private feed, and dotnet nuget push for your own ids.
- Allow lists and block lists Whitelist or blacklist by name, scope, wildcard or version range, for every type. A blocked version is not even listed to the client.
- Vulnerability monitoring OSV, CISA KEV and FIRST EPSS against everything allowed and cached. npm audit answered locally.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.