It’s just there. Just like the stars, just like electricity, just like Java.

In the the Java world Maven central is the most important single service. You can get Java SDKs and even container images from various vendors but Java code comes from only one place: Maven central.

Maven central is sooo boring, sooo reliable that it’s understandable that we all take it for granted.

Recently though we’ve seen questions raised about the Java code that is hosted there. Other repositories have been experiencing unprecedented attempts to upload malware and even in the Java world there are significant vulnerabilities that some have called to be removed.

This talk is intended to give you the background into the history of Maven central, explain why Sonatype, who are the stewards of Maven Central, provide such a critical service and what our philosophy is for dealing with problematic content. We’ll also explore how the service works under the covers, the API’s you might not be aware of and what’s coming up next.

Maven Central is not going away - but it might just get more exciting!