Do I need to be careful which Maven Repositories I hook into?

Question

Generally speaking, should one only add the central Maven Repository to a pom.xml + optionally any local Maven Repositories ? In theory (I think?) anybody can set up a repository - is there a 'Maven Repository<->Maven Repository' circle of trust or something ?

How do I know for instance that I'm really downloading (say) the log4j compiled JARs and not some bastardized / evil version ?

Answer 1

Few things you can do to feel comfortable:

• Use a local repository manager like Nexus or JFrog, and proxy any repositories that you want to use. There are few benefits to this:
  • A local manager can keep track of the SHA hashes to make sure that a jar didn't change under your feet.
  • You can limit the repositories that your developers can access.
• Stick with Maven Central when you can - so many people use it that if someone switched out the log4j version with something untrustworthy everyone would know very quickly (because the hashes wouldn't line up). Generally this argument will also hold true for any other repositories that hold popular libraries (eg sourceforge, google code, codehaus, etc)
• Things are only likely to get risky if you're using some dude's repo who wrote some library that's not very popular out in the wild. In practice this rarely happens. In those cases, maybe you can just build the code yourself to be sure.

Answer 2

Best practice is not to add any repository into the pom.xml. The best solution is to configure either into the settings.xml or the best solution is to use a repository manager. Furthermore the best thing is to work with maven central if you don't have a repo-manager, but for that you don't need to configure anything, cause Maven Central is the default within Maven itself. Maven Central is control adminstrative by people of Sonatype and it is not that simple to get something into Maven Central. What you can do to secure the transport a little bit more is to turn on the checksum checking which is controled by a configuration in the settings.xml.