It’s just there. Just like the stars, just like electricity, just like Java.

In the Java world Maven central is the most important single service. You can get Java SDKs and even container images from various vendors but Java code comes from only one place: Maven central.

Serving overt 10 billion requests a week, Maven Central is sooo boring, sooo reliable that it’s understandable that it’s mostly invisible. It’s just there.

Recently though we’ve seen questions raised about the Java code that is hosted there. Other repositories have been experiencing unprecedented attempts to upload malware and even in the Java world there are significant vulnerabilities that some have called to be removed.

This talk is intended to give you the background of Maven central and what the philosophy is for dealing with problematic content.

We’ll also explore how the service works under the covers, the API’s you might not be aware of and what’s coming up next.

Maven Central is not going away - but it might just get more exciting!