The Secret Life of Maven Central
•Download as PPTX, PDF•
0 likes•10 views
It’s just there. Just like the stars, just like electricity, just like Java. In the Java world Maven central is the most important single service. You can get Java SDKs and even container images from various vendors but Java code comes from only one place: Maven central. Serving overt 10 billion requests a week, Maven Central is sooo boring, sooo reliable that it’s understandable that it’s mostly invisible. It’s just there. Recently though we’ve seen questions raised about the Java code that is hosted there. Other repositories have been experiencing unprecedented attempts to upload malware and even in the Java world there are significant vulnerabilities that some have called to be removed. This talk is intended to give you the background of Maven central and what the philosophy is for dealing with problematic content. We’ll also explore how the service works under the covers, the API’s you might not be aware of and what’s coming up next. Maven Central is not going away - but it might just get more exciting!
Recommended
More Related Content
Similar to The Secret Life of Maven Central
Similar to The Secret Life of Maven Central (20)
More from Steve Poole
More from Steve Poole (18)
Recently uploaded
Recently uploaded (20)
The Secret Life of Maven Central
- 1. @spoole167 The Secret Life of Maven Central JavaZone 2022 Steve Poole
- 2. @spoole167 Steve Poole Developer advocate @ Sonatype
- 3. @spoole167 @spoole167 The Secret Life of Maven Central – starts with you
- 4. @spoole167 @spoole167 At some point we all find ourselves searching for code …
- 5. @spoole167 so we can add a new dependency
- 6. @spoole167 Whatever your preferred language or build system
- 7. @spoole167 90% of modern applications are open source dependencies Our applications live or die off dependency management and repositories
- 8. @spoole167 repo.maven.apache.org Like the stars in the sky – it’s just there
- 9. @spoole167 9 Outline What is Maven Central Why we need to evolve it Your Homework Q&A
- 10. @spoole167 Maven Central @ maven.org seems to have been with us for ever …
- 12. @spoole167 These two were instrumental in Maven and Maven Central
- 14. @spoole167 2005: Apache Maven the project moved over to a new home while the central repo stayed. Still funded by public donation
- 17. @spoole167 Image source: Blind men and an elephant, https://en.wikipedia.org/w/index.php?title=Blind_men_and_an_elephant&oldid=1085926226 (last visited May 8, 2022). Maven Central outgrew it’s origins
- 20. @spoole167 Statistics as of 6 May 2022 component versions stored in … 79k 27TB 8.8m … of files representing approximately … … namespaces / organizations / publishers Central by the Numbers
- 21. @spoole167 Central by the Numbers 496BILLION In 2021, developers around the world made more than requests from Maven Central.
- 23. @spoole167 And not just in Java
- 24. @spoole167 Central by the Numbers $£€ But it’s what we do In the end running a service like Maven Central is expensive Our roots and our business makes it a core value to keep Maven Central a vibrant, useful and safe place
- 25. @spoole167 @spoole167 There’s one more thing that costs..
- 27. @spoole167 @spoole167 Maven central has multiple layers of protection. The first is easy. Prove you own the domain!
- 28. @spoole167 @spoole167 Proof of domain ownership Helps reduce malware ending up in the repository org.apache.logging.log4j:999.999.999 org.apache.logging.logj4:2.18 org.apaceh.logging.log4j
- 29. @spoole167 @spoole167 Proof of domain ownership Helps reduce malware ending up in the repository org.apache.logging.log4j:999.999.999 org.apache.logging.logj4:2.18 org.apaceh.logging.log4j Typo-squatting Dependency confusion Typo-squatting
- 30. @spoole167 @spoole167 Proof of domain ownership Helps reduce malware ending up in the repository org.apache.logging.log4j:999.999.999 org.apache.logging.logj4:2.18 org.apaceh.logging.log4j Defeated Defeated Allowed
- 31. @spoole167 @spoole167 Proof of domain ownership Helps reduce malware ending up in the repository org.apache.logging.log4j:999.999.999 org.apache.logging.logj4:2.18 org.apaceh.logging.log4j Defeated Defeated Allowed
- 32. @spoole167 Proof of domain ownership Keeps the malware bots away
- 33. @spoole167 @spoole167 Everything else is hard Does the new package contain vulnerabilities? How do you figure that out? Do you stop code being published? Does the new package contain active malware? How do you figure that out? Do you stop code being published? How do you make sure consumers know what they getting?
- 34. @spoole167 @spoole167 For Maven Central Sonatype scans everything uploaded with it’s commercial scanners. Only malware is rejected
- 35. @spoole167 @spoole167 For Maven Central Finding out about vulnerabilities before you select a version is straightforward Accuracy depends on the quality of the scanning tools , the skills of the research team and the skills of the bad guys. All are always getting better
- 36. @spoole167 @spoole167 Unfortunately, developers are slow to change
- 37. @spoole167 log4j downloads https://www.sonatype.com/resources/log4j-vulnerability-resource-center
- 39. @spoole167 @spoole167 The bad guys have evolved
- 40. @spoole167 @spoole167 Cyber Attacks are rising in number and sophistication Nation states are preparing for the next war – and that all about software The aim is to infiltrate infrastructure and essential services…
- 41. @spoole167 @spoole167 And manipulate or terminate
- 42. @spoole167 @spoole167 The field of battle Typo-squatting Dependency Confusion Vulnerability exploitation Vulnerability research Build System compromised Tools compromised Open Source project compromise Maven Central is evolving to give you more insight and better defenses
- 43. @spoole167 @spoole167 The field of battle Typo-squatting Dependency Confusion Vulnerability exploitation Vulnerability research Build System compromised Tools compromised Open Source project compromise
- 44. @spoole167 @spoole167 Highlighting popular packages and publishers Publishers will be able to use the same UI for consuming/researching and getting support Sign in required for publishers and enhanced metadata. Updated Central Portal
- 45. @spoole167 More .. SBOM support across the lifecycle SIG store support Cross industry best practices Enhanced Developer Intelligence Your input please
- 47. @spoole167 Enhanced Developer Intelligence More focus on the open source projects themselves Using tools to assess projects Figuring out ways to ‘score’ the assessments
- 48. @spoole167 Enhanced Developer Intelligence More focus on best behavior and sharing that knowledge
- 49. @spoole167 Enhanced Developer Intelligence Working out what works and what’s useful.
- 50. @spoole167 Enhanced Developer Intelligence Working out what works and what’s useful. We need your input on the choices you make and why.
- 51. @spoole167 Enhanced Developer Fun We’d like a logo or two for Maven Central
- 52. @spoole167 Want to help? Sign up for Beta access to the Portal: https://central-beta.sonatype.org Reach out to me @spoole167 https://www.linkedin.com/in/noregressions/ Keep an eye open for a more formal request