Why external repos are being phased out of Central

We recently started raising the minimum criteria for artifacts coming into Central:

• Blind rsync transfers of random repositories are no longer being added and will be phased out over time
• All artifacts must be properly signed with GPG signatures that are publicly verifiable
• sources and javadocs must be included
• scm urls must be included
• No external repository definitions

That last one seems to cause the most commotion for users that depend on artifacts not currently in Central and I wanted to take this opportunity to show why this is being done.

The urls you see below are listed as RELEASE repositories found in the poms of a prominent repo we're attempting to clean for syncing to Central. In the list below you will find some interesting bits:

• file based urls
• urls with private ip subnets
• snapshot repositories (remember this is a list of the RELEASE repos only according to the poms
• Links to websites (like [http://maven.apache.org]) or wikis
• Many sites that no longer exist
• Repositories that are actually mirrors of Central (Ibiblio)
• Repositories who's contents are already in Central (codehaus)

Of the few repositories that actually do still work, many of them have what I would call "garbage" in them. I'll define garbage here as things that didn't originate from this project and are either hacked/patched versions and/or duplicates of artifacts that are found somewhere else.

When you start blindly using these repos, best case you could get artifacts who's provenance is suspect and your builds are slowed down because Maven is sent off on a wild goose chase. Worst case, you still have to find these repos by hand and override the bad urls.

In the list below, I think my favorite is the dynamic search of a Fisheye repository at Atlassian.com. I'm sure they love having thousands of builds doing automated searches of their Fisheye service looking for every artifact in a build.

• file://${basedir}/src/repository
• file:${brillien_basedir}/../lib
• file:${project.basedir}/lib
• file:${project.basedir}/lib/
• http://10.5.5.82:8081/artifactory/plugins-releases
• http://10.5.5.82:8081/artifactory/plugins-snapshots
• http://archiva.openqa.org/repository/releases/
• http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/nct-core-releases
• http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/nct-core-snapshots
• http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/repo
• http://bits.netbeans.org/maven2
• http://cvs.apache.org/maven-snapshot-repository
• http://developer.jasig.org/repo/content/groups/m2-legacy/
• http://dist.codehaus.org/mule/dependencies/maven2
• http://download.csssprites.org/maven2/
• http://download.java.net/javaee5/external/shared
• http://download.oracle.com/maven
• http://easymock.org/maven/repository
• http://egit.googlecode.com/svn/maven/snapshot-repository
• http://fest.googlecode.com/svn/trunk/fest/m2/repository
• http://fforw.de/m2repo/releases/
• http://fisheye4.atlassian.com/browse/~raw,r=trunk/hudson/trunk/hudson/plugins/git/maven-repository
• http://groovydice.sourceforge.net/m2repo
• http://guiceyfruit.googlecode.com/svn/repo/releases
• http://java.freehep.org/maven2
• http://jets3t.s3.amazonaws.com/maven2
• http://jflex.sourceforge.net/repo/
• http://maven1.glassfishwiki.org/
• http://maven.apache.org
• http://maven.dyndns.org/2
• http://maven.dyndns.org/glassfish/
• http://maven.glassfish.org/content/groups/glassfish
• http://maven.glassfish.org/content/groups/public/
• http://maven.ocean.net.au/external
• http://maven.ocean.net.au/release
• http://maven.ocean.net.au/snapshot
• http://maven.restlet.org
• http://maven.sfbay/mirrors/java.net
• http://mirrors.ibiblio.org/pub/mirrors/maven2
• http://ndeloof.free.fr/maven2
• http://nexus.openqa.org/content/repositories/releases
• http://oss.repository.sonatype.org/content/groups/cometd
• http://people.apache.org/maven-snapshot-repository
• http://people.apache.org/~mrdon/repository/
• http://people.apache.org/repo/m2-incubating-repository
• http://people.apache.org/repo/m2-snapshot-repository
• http://people.apache.org/repo/m2-snapshot-repository/
• http://repo1.maven.org/maven2
• http://repo1.maven.org/maven2/
• http://repo2.maven.org/maven2
• http://repo2.maven.org/maven/2
• http://repo.aduna-software.org/maven2/releases
• http://repo.ddsteps.org/maven/release/
• http://repo.nhncorp.com/maven2
• http://repo.opennms.org/maven2
• http://repository.codehaus.org
• http://repository.ops4j.org/maven2
• http://repository.ops4j.org/maven2/
• http://scala-tools.org/repo-snapshots/
• https://games-darkstar.dev.java.net/nonav/snapshots
• https://hudson.dev.java.net/source/browse/*checkout*/hudson/hudson/main/lib
• https://m2proxy.atlassian.com/repository/public
• https://maven2-repository.dev.java.net/nonav/repository
• https://maven2-repository.dev.java.net/nonav/repository/
• https://maven.atlassian.com/content/groups/public/
• https://maven-repository.dev.java.net/nonav/repository
• https://maven-repository.dev.java.net/nonav/repository/
• https://maven-repository.dev.java.net/repository
• https://maven-repository.dev.java.net/repository/
• http://snapshots.jboss.org/maven2
• http://snapshots.repository.codehaus.org/
• http://source.db4o.com/maven
• http://sshd.googlecode.com/svn/m2-repo
• http://svn.apache.org/repos/asf/servicemix/m2-repo
• http://svn.magnolia.info/maven/m2
• http://svn.sonatype.org/flexmojos/repository/
• http://tek42.com/maven2
• http://wicketstuff.org/maven/repository
• http://www.agilejava.com/maven/
• http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/rt/eclipselink/maven.repo
• http://www.eviware.com/repository/maven2/
• http://www.ibiblio.org/maven
• http://www.ibiblio.org/maven2
• http://www.ibiblio.org/maven2/
• http://yusuke.homeip.net/maven2

When we sync these poms to Central, it is highly likely we will simply ditch all of these references. We don't take changing poms likely, but in this case it is clearly the lesser of two evils. Having the ability to leverage artifacts in some other repo is a nice fix in the moment, but once you release your project this way, you forever become a slave to that project maintaining the repo.

In order to improve the experience for everyone, we are working to block this from happening in Central. We have several efforts underway to help minimize this impact, and that primarily includes making it easier to get your artifacts and third party artifacts into Central. Stay tuned for more exciting announcements on this topic.