It’s just there. Just like the stars, just like electricity, just like Java. In the Java world Maven central is the most important single service. You can get Java SDKs and even container images from various vendors but Java code comes from only one place: Maven central. Serving overt 10 billion requests a week, Maven Central is sooo boring, sooo reliable that it’s understandable that it’s mostly invisible. It’s just there. Recently though we’ve seen questions raised about the Java code that is hosted there. Other repositories have been experiencing unprecedented attempts to upload malware and even in the Java world there are significant vulnerabilities that some have called to be removed. This talk is intended to give you the background of Maven central, explain why Sonatype,( who are the stewards of Maven Central), provide such a critical service and what our philosophy is for dealing with problematic content. We’ll also explore how the service works under the covers, the API’s you might not be aware of and what’s coming up next. Maven Central is not going away - but it might just get more exciting!

1. @spoole167
The Secret Life of Maven Central
JavaZone 2022
Steve Poole

2. @spoole167
Steve Poole
Developer advocate @ Sonatype

3. @spoole167
@spoole167
The Secret Life of Maven Central – starts
with you

4. @spoole167
@spoole167
At some point we all find ourselves
searching for code …

5. @spoole167
so we can add a
new dependency

6. @spoole167
Whatever your preferred language or build system

7. @spoole167
90% of modern applications are
open source dependencies
Our applications live or die off
dependency management and
repositories

8. @spoole167
repo.maven.apache.org
Like the stars in the sky
– it’s just there

9. @spoole167
9
Outline What is Maven Central
Why we need to evolve it
Your Homework
Q&A

10. @spoole167
Maven Central @ maven.org seems to have
been with us for ever …

11. @spoole167
Not quite.
maven.org
1999 style

12. @spoole167
These two were instrumental in Maven and
Maven Central

13. @spoole167
2003:
funded by
public
donations

14. @spoole167
2005: Apache
Maven the
project moved
over to a new
home while the
central repo
stayed.
Still funded by
public donation

15. @spoole167
2022:
Funded by
Sonatype

16. @spoole167
2022:
Funded by
Sonatype Why?

17. @spoole167
Image source: Blind men and an elephant,
https://en.wikipedia.org/w/index.php?title=Blind_men_and_an_elephant&oldid=1085926226 (last visited May 8, 2022).
Maven Central outgrew it’s origins

18. @spoole167
High-Level
Architecture
Publishers
Repo Users
Search Users

19. @spoole167
Plus, of
course an
API

20. @spoole167
Statistics as of
6 May 2022
component versions
stored in …
79k
27TB
8.8m
… of files representing
approximately …
… namespaces /
organizations /
publishers
Central
by the
Numbers

21. @spoole167
Central
by the
Numbers
496BILLION
In 2021, developers around
the world made more than
requests from Maven Central.

22. @spoole167
Demand
continues to
increase

23. @spoole167
And not just in Java

24. @spoole167
Central
by the
Numbers
$£€
But it’s
what we do
In the end running a service like
Maven Central is expensive
Our roots and our business makes it
a core value to keep Maven Central
a vibrant, useful and safe place

25. @spoole167
@spoole167
There’s one more thing that costs..

26. @spoole167
@spoole167
keeping your application safe

27. @spoole167
@spoole167
Maven central
has multiple
layers of
protection.
The first is easy.
Prove you own the domain!

28. @spoole167
@spoole167
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j

29. @spoole167
@spoole167
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j
Typo-squatting
Dependency confusion
Typo-squatting

30. @spoole167
@spoole167
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j
Defeated
Defeated
Allowed

31. @spoole167
@spoole167
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j
Defeated
Defeated
Allowed

32. @spoole167
Proof of
domain
ownership
Keeps the
malware bots
away

33. @spoole167
@spoole167
Everything else is hard
Does the new package contain vulnerabilities?
How do you figure that out?
Do you stop code being published?
Does the new package contain active malware?
How do you figure that out?
Do you stop code being published?
How do you make sure consumers know what they getting?

34. @spoole167
@spoole167
For Maven Central
Sonatype scans
everything
uploaded with it’s
commercial
scanners.
Only malware is
rejected

35. @spoole167
@spoole167
For Maven Central
Finding out about vulnerabilities
before you select a version is
straightforward
Accuracy depends on the quality of
the scanning tools , the skills of the
research team and the skills of the
bad guys.
All are always getting better

36. @spoole167
@spoole167
Unfortunately, developers are slow to
change

37. @spoole167
log4j
downloads
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

38. @spoole167
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

39. @spoole167
@spoole167
The bad guys have evolved

40. @spoole167
@spoole167
Cyber Attacks are rising in number and
sophistication
Nation states are preparing for the next war – and that all about
software
The aim is to infiltrate infrastructure and essential services…

41. @spoole167
@spoole167
And manipulate or terminate

42. @spoole167
@spoole167
The field of battle
Typo-squatting
Dependency Confusion
Vulnerability exploitation
Vulnerability research
Build System compromised
Tools compromised
Open Source project compromise
Maven Central is
evolving to give you
more insight and
better defenses

43. @spoole167
@spoole167
The field of battle
Typo-squatting
Dependency Confusion
Vulnerability exploitation
Vulnerability research
Build System compromised
Tools compromised
Open Source project compromise

44. @spoole167
@spoole167
Highlighting
popular packages
and publishers
Publishers will be able to
use the same UI for
consuming/researching and
getting support
Sign in required for
publishers and enhanced
metadata.
Updated Central Portal

45. @spoole167
More ..
SBOM support across the
lifecycle
SIG store support
Cross industry best practices
Enhanced Developer Intelligence Your input please

46. @spoole167
Enhanced
Developer
Intelligence
More consumable and
understandable data

47. @spoole167
Enhanced
Developer
Intelligence
More focus on the
open source
projects themselves
Using tools to assess projects
Figuring out ways to ‘score’ the
assessments

48. @spoole167
Enhanced
Developer
Intelligence
More focus on best
behavior and
sharing that
knowledge

49. @spoole167
Enhanced
Developer
Intelligence
Working out what
works and what’s
useful.

50. @spoole167
Enhanced
Developer
Intelligence
Working out what
works and what’s
useful.
We need your input on the choices you make
and why.

51. @spoole167
Enhanced
Developer
Fun
We’d like a logo or two for Maven Central

52. @spoole167
Want to help?
Sign up for Beta access to the Portal:
https://central-beta.sonatype.org
Reach out to me
@spoole167
https://www.linkedin.com/in/noregressions/
Keep an eye open for a more formal request

53. @spoole167
Q&A
Any Questions?