Dependably Packages · Maven
A private Maven repository for Maven and Gradle
One repository URL for Maven and Gradle. Central artefacts come through a pull-through cache that verifies every checksum; your own artefacts publish with a token; the policy gate decides what reaches a build.
Maven · Gradle
Point Maven at your registry
The repository goes in the project; the token stays in your user settings file, never in the repository. A catch-all mirror routes every dependency through it.
The placeholders are your base URL and a token from the web UI.
<!-- pom.xml -->
<repositories>
<repository>
<id>dependably</id>
<url>https://repo.example.com/maven/</url>
</repository>
</repositories>
<!-- ~/.m2/settings.xml: the token stays out of the project -->
<servers>
<server>
<id>dependably</id>
<username>user</username>
<password><your token></password>
</server>
</servers>What happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
- A name your organization reserves cannot be squatted upstream and resolved into your builds.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The Maven guide continues with a verification step, publishing your own packages, and reverting the configuration.