Dependably Packages · Maven

A private Maven repository for Maven and Gradle

One repository URL for Maven and Gradle. Central artefacts come through a pull-through cache that verifies every checksum; your own artefacts publish with a token; the policy gate decides what reaches a build.

Maven · Gradle

Point Maven at your registry

The repository goes in the project; the token stays in your user settings file, never in the repository. A catch-all mirror routes every dependency through it.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

xml · repo.example.com
<!-- pom.xml -->
<repositories>
  <repository>
    <id>dependably</id>
    <url>https://repo.example.com/maven/</url>
  </repository>
</repositories>

<!-- ~/.m2/settings.xml: the token stays out of the project -->
<servers>
  <server>
    <id>dependably</id>
    <username>user</username>
    <password><your token></password>
  </server>
</servers>

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

  • The checksum is verified against the digest the upstream publishes before the artefact is stored.
  • The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
  • A name your organization reserves cannot be squatted upstream and resolved into your builds.
  • Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The Maven guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.