Maven

Maven 2 layout repository for mvn and other Maven-protocol clients; maven-metadata.xml and checksums are generated by the server.

Format id	maven
Repo URL	HOST/repos/maven/REPO
Repository types	hosted, proxy, group (details)

Client setup

internal/clientsetup produces this configuration, with a token as the password:

<!-- ~/.m2/settings.xml -->
<settings>
  <servers>
    <server>
      <id>REPO</id>
      <username>USERNAME</username>
      <password>TOKEN</password>
    </server>
  </servers>
</settings>

mvn deploy -DaltDeploymentRepository=REPO::default::HOST/repos/maven/REPO

To resolve dependencies, add the repository to pom.xml (the id must match the <server> id when credentials are needed):

<repositories>
  <repository>
    <id>REPO</id>
    <url>HOST/repos/maven/REPO</url>
  </repository>
</repositories>

Upload

Upload is the plain Maven wire protocol: PUT /repos/maven/REPO/<group/path>/<artifactId>/<version>/<file>, one request per file. There is no separate REST upload endpoint.

Request	Behaviour
PUT <path>	stores the file; 201 when new, 200 when replaced or identical. Response header X-Oa-Artifact-Id carries the package id used by the properties API
PUT <file>.md5|.sha1|.sha256|.sha512	acknowledged with 200 and discarded: all four checksums are computed server-side while the file is received
PUT .../maven-metadata.xml	acknowledged with 200 and discarded: metadata is always generated
DELETE <path>	removes one file, 204; a path ending in / is 405
MKCOL, HEAD, GET	MKCOL answers 200 (WebDAV clients); HEAD and GET read

Rules checked on PUT:

• The path must parse as group/artifactId/version/filename, else 400 invalid maven repository path.
• The file name must start with <artifactId>-<version> (for timestamped snapshots <artifactId>-<base>-<yyyyMMdd.HHmmss>-<build>), followed by an optional -<classifier> and the extension. Otherwise 400. Extensions may contain dots (tar.gz, jar.asc); signatures such as .asc are stored as ordinary files.
• Release versions are immutable: re-publishing identical content is 200; different content is 409 with {"error": "release artifact already exists with different content"}.
• -SNAPSHOT versions can be overwritten.
• With immutable_releases on the repository, an overwrite of an existing release file is refused with 409 even when the content would otherwise be replaced, and deleting a release is 409 unless an admin passes ?force=true (immutable releases). Deletes of other files go to the trash by default.
• Maximum body 1 GiB per file; quota is enforced (quotas).
• Proxy and group repositories answer 405 (Allow: GET, HEAD).

Read and generated metadata

• Checksum requests (<file>.md5, .sha1, .sha256, .sha512) return <hash> <filename> from values stored at upload.
• A request for a <artifact>-<version>-SNAPSHOT[-<classifier>].<ext> file name (and its checksums) resolves to the newest timestamped build of that exact classifier and extension; an unknown classifier is 404.
• HEAD answers like GET (same status, ETag, quarantine rules and real Content-Length) without a body.
• Files are served with ETag: "<sha256>" and Cache-Control: public, max-age=300.
• maven-metadata.xml exists at artifact level (group/path/artifactId/maven-metadata.xml: versions sorted by Maven version order, latest, release = newest non-snapshot, lastUpdated) and for every snapshot version (group/path/artifactId/<version>-SNAPSHOT/maven-metadata.xml: current timestamp/buildNumber and the newest snapshotVersion per extension and classifier).
• Metadata is regenerated by a background worker, debounced 500 ms after each upload or delete, so it can lag a just-finished deploy by a moment. A client-supplied maven-metadata.xml is never stored.
• Deleting the last file of an artifact does not remove its generated maven-metadata.xml.

Proxy and group

• Proxy: requests are mirrored by path from upstream_url, cached content-addressed and recorded under the repository. Released artifacts (not -SNAPSHOT, not maven-metadata*.xml, not archetype-catalog.xml) and their checksum and signature files (.md5, .sha1, .sha256, .sha512, .asc) are immutable once cached; maven-metadata.xml, archetype-catalog.xml and -SNAPSHOT files (and their checksums) are revalidated after cache_ttl_seconds. An HTML answer for a .jar, .pom or .zip path (a captive portal page) is refused with 502 and not cached. Negative caching, serve-stale and SSRF rules are in hosted, proxy, group.
• Group: an ordered list of hosted and proxy Maven members; the first member holding the file answers, and each member is authorized for the caller as if requested directly. maven-metadata.xml and its checksums are merged across readable members (versions united and ordered, latest, release and lastUpdated recomputed).

Signing

Maven repositories have no repository-level signature and no public.key. GPG keys configured for the server sign only Debian and RPM metadata (signing).