It’s just there. Just like the stars, just like electricity, just like Java. In the Java world Maven, central is the most important single service. You can get Java SDKs and even container images from various vendors, but Java code comes from only one place: Maven central. Maven central is so reliable that it’s understandable that we all take it for granted. Recently though we’ve seen questions raised about the Java code that is hosted there. Other repositories have been experiencing unprecedented attempts to upload malware and even in the Java world, there are significant vulnerabilities that some have called to be removed. This talk is intended to give you the background into the history of Maven central, explain why Sonatype, who are the stewards of Maven Central, provide such a critical service and what our philosophy is for dealing with problematic content. We’ll also explore how the service works under the covers, the APIs you might not be aware of and what’s coming up next. Maven Central is not going away - but it might just get more exciting!

1. @Jamie_Lee_C
The Secret Life of Maven Central
Jamie Lee Coleman

2. @Jamie_Lee_C
@Jamie_Lee_C
Introduction
About me
Name: Jamie Lee Coleman
Current Role: Developer Advocate @ Sonatype
Past experience: Developer in Mainframe Software (CICS), WebSphere & OpenJ9 @
IBM
Twitter: @Jamie_Lee_C
Linked-In: https://www.linkedin.com/in/jamie-coleman/

3. @Jamie_Lee_C

4. @Jamie_Lee_C
Not just the Maven Central people

5. @Jamie_Lee_C
@Jamie_Lee_C

6. @Jamie_Lee_C
Open Source is amazing!

7. @Jamie_Lee_C
Benefits of FOSS
Personal control and
customizability (4 main
FOSS freedoms)
Study
Copy
Modify
Redistribute
Privacy and Security*
Use community to find bugs
quickly
Low or no costs
Software is free with optional
licencing
Quality, collaboration and
efficiency
Many people and
organizations working together
Performance can be much
better due to the amount of
people contributing
Project development can
become more agile and
efficient

8. @Jamie_Lee_C
Sharing = better!
90% of the applications we create are shared dependencies!

9. @Jamie_Lee_C
Dependency Licence Managment
150 Dependencies(avg Java project)
10 Releases Per Year (avg per dependency)
1500 Possible License updates To Consider 😱
x

10. @Jamie_Lee_C
Direct vs Transitive Dependency
Example: org.springframework.boot:spring-boot-starter-web

11. @Jamie_Lee_C
@Jamie_Lee_C
The Secret Life of Maven Central
It starts with you!

12. @Jamie_Lee_C
@Jamie_Lee_C
At some point we all find ourselves
searching for code …

13. @Jamie_Lee_C
so we can add a
new dependency

14. @Jamie_Lee_C
Whatever your preferred language or build system

15. @Jamie_Lee_C
90% of modern applications are
open source dependencies
Our applications live or die off
dependency management and
repositories

16. @Jamie_Lee_C
repo.maven.apache.org
Like the stars in the sky
– it’s just there

17. @Jamie_Lee_C
17
Outline What is Maven Central
Why we need to evolve it
Your Homework
Q&A

18. @Jamie_Lee_C
Maven Central @ maven.org seems to have
been with us for ever …

19. @Jamie_Lee_C
Not quite.
maven.org
1999 style

20. @Jamie_Lee_C
These two were instrumental in Maven and
Maven Central

21. @Jamie_Lee_C
2003:
funded by
public
donations

22. @Jamie_Lee_C
2005: Apache
Maven the
project moved
over to a new
home while the
central repo
stayed.
Still funded by
public donation

23. @Jamie_Lee_C
2022:
Funded by
Sonatype

24. @Jamie_Lee_C
2022:
Funded by
Sonatype Why?

25. @Jamie_Lee_C
Image source: Blind men and an elephant,
https://en.wikipedia.org/w/index.php?title=Blind_men_and_an_elephant&oldid=1085926226 (last visited May 8, 2022).
Maven Central outgrew it’s origins

26. @Jamie_Lee_C
High-Level
Architecture
Publishers
Repo Users
Search Users

27. @Jamie_Lee_C
Plus, of
course an
API

28. @Jamie_Lee_C
The Data

29. @Jamie_Lee_C
Comparing Open-source Repos

30. @Jamie_Lee_C
Statistics as of
6 May 2022
component versions
stored in …
79k
27TB
8.8m
… of files representing
approximately …
… namespaces /
organizations /
publishers
Central
by the
Numbers

31. @Jamie_Lee_C
Central
by the
Numbers
496BILLION
In 2021, developers around
the world made more than
requests from Maven Central.

32. @Jamie_Lee_C
And not just in Java

33. @Jamie_Lee_C
• Java (Maven) Through the first 7
months of 2023, 512 billion Java
components were requested from
the Maven Cen - tral Repository. This
is a significant jump compared to the
821 billion requests in 2022. Java
continues to grow at a healthy pace,
hitting an estimated 25% YoY
request growth rate. If previous years
are any indication, we may well see a
spike towards the end of the year
Maven
Central
Growth

34. @Jamie_Lee_C
Central
by the
Numbers
$£€
But it’s
what we do
In the end running a service like
Maven Central is expensive
Our roots and our business makes it
a core value to keep Maven Central
a vibrant, useful and safe place

35. @Jamie_Lee_C
@Jamie_Lee_C
There’s one more thing that costs..

36. @Jamie_Lee_C
@Jamie_Lee_C
keeping your application safe

37. @Jamie_Lee_C
@Jamie_Lee_C
Maven central
has multiple
layers of
protection.
The first is easy.
Prove you own the domain!

38. @Jamie_Lee_C
@Jamie_Lee_C
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j

39. @Jamie_Lee_C
@Jamie_Lee_C
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j
Typo-squatting
Dependency confusion
Typo-squatting

40. @Jamie_Lee_C
@Jamie_Lee_C
Proof of domain ownership
Helps reduce malware ending up in the repository
org.apache.logging.log4j:999.999.999
org.apache.logging.logj4:2.18
org.apaceh.logging.log4j
Defeated
Defeated
Allowed

41. @Jamie_Lee_C
Proof of
domain
ownership
Keeps the
malware bots
away

42. @Jamie_Lee_C
@Jamie_Lee_C
Everything else is hard
Does the new package contain vulnerabilities?
How do you figure that out?
Do you stop code being published?
Does the new package contain active malware?
How do you figure that out?
Do you stop code being published?
How do you make sure consumers know what they getting?

43. @Jamie_Lee_C
@Jamie_Lee_C
For Maven Central
Sonatype scans
everything
uploaded with it’s
commercial
scanners.
Only malware is
rejected

44. @Jamie_Lee_C
@Jamie_Lee_C
For Maven Central
Finding out about vulnerabilities
before you select a version is
straightforward
Accuracy depends on the quality of
the scanning tools , the skills of the
research team and the skills of the
bad guys.
All are always getting better

45. @Jamie_Lee_C
Why software security matters!

46. @Jamie_Lee_C

47. @Jamie_Lee_C

48. @Jamie_Lee_C

49. @Jamie_Lee_C
Cyber Crime Facts
In 2016 Cybercrime surpassed the
drug trade!
$450 Billion a year
$14,000 a second
Equivalent to 50 US Nimitz Class
Aircraft carriers

50. @Jamie_Lee_C
What about 2022?

51. @Jamie_Lee_C
@Jamie_Lee_C
Cyber Crime Facts
In 2022!
$6 Trillion a year!
$200,000 a second
Equivalent to 620 US Nimitz
Class Aircraft carriers!

52. @Jamie_Lee_C
If Cybercrime was a country by GDP in 2022
United States: $25.46 trillion
China: $17.93 trillion
Cyber Crime: $6 trillion+
Japan: $4.23 trillion
Germany: $4.07 trillion
India: $3.38 trillion
United Kingdom: $3.07 trillion
France: $2.78 trillion

53. @Jamie_Lee_C
@Jamie_Lee_C
Todays Pablo Escobar uses a Laptop

54. @Jamie_Lee_C
@Jamie_Lee_C

55. @Jamie_Lee_C
@Jamie_Lee_C
Devices allowed to contain OS code:
IEC 62304

56. @Jamie_Lee_C
@Jamie_Lee_C
Unfortunately, developers are slow to
change

57. @Jamie_Lee_C
log4j
downloads
in May 2021
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

58. @Jamie_Lee_C
log4j
downloads
Now
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

59. @Jamie_Lee_C
log4j
downloads
Now
https://www.sonatype.com/resources/log4j-vulnerability-resource-center

60. @Jamie_Lee_C
Simple
steps to get
started

61. @Jamie_Lee_C
Simple
steps to get
started

62. @Jamie_Lee_C
@Jamie_Lee_C
The bad guys have evolved

63. @Jamie_Lee_C
@Jamie_Lee_C
Cyber Attacks are rising in number and
sophistication
Nation states are preparing for the next war – and that all about
software
The aim is to infiltrate infrastructure and essential services…

64. @Jamie_Lee_C
@Jamie_Lee_C
And manipulate or terminate

65. @Jamie_Lee_C
@Jamie_Lee_C
The field of battle
Typo-squatting
Dependency Confusion
Vulnerability exploitation
Vulnerability research
Build System compromised
Tools compromised
Open Source project compromise

66. @Jamie_Lee_C
@Jamie_Lee_C
The field of battle
Typo-squatting
Dependency Confusion
Vulnerability exploitation
Vulnerability research
Build System compromised
Tools compromised
Open Source project compromise
Maven Central is
evolving to give you
more insight and
better defenses

67. @Jamie_Lee_C
@Jamie_Lee_C
Highlighting
popular packages
and publishers
Publishers will be able to
use the same UI for
consuming/researching and
getting support
Sign in required for
publishers and enhanced
metadata.
Updated Central Portal

68. @Jamie_Lee_C
More ..
SBOM support across the
lifecycle
SIG store support
Cross industry best practices
Enhanced Developer Intelligence Your input please

69. @Jamie_Lee_C
Enhanced
Developer
Intelligence
More consumable and
understandable data

70. @Jamie_Lee_C
Enhanced
Developer
Intelligence
More focus on the
open source
projects themselves
Using tools to assess projects
Figuring out ways to ‘score’ the
assessments

71. @Jamie_Lee_C
Enhanced
Developer
Intelligence
More focus on best
behavior and
sharing that
knowledge

72. @Jamie_Lee_C
Enhanced
Developer
Intelligence
Working out what
works and what’s
useful.

73. @Jamie_Lee_C
Enhanced
Developer
Intelligence
Working out what
works and what’s
useful.
We need your input on the choices you make
and why.

74. @Jamie_Lee_C
Enhanced
Developer
Fun
We’d like a logo or two for Maven Central

75. @Jamie_Lee_C
Want to help?
Reach out to me
@Jamie_Lee_C
https://www.linkedin.com/in/jamie-coleman/
Keep an eye open for a more formal request

76. @Jamie_Lee_C
Q&A
Any Questions?

77. @Jamie_Lee_C
Thank you