Search code examples
mavendependenciesrepositorybuild-systemjcenter

Does Maven Central still not use CDN for distribution?

I read articles from 3 years back highlighting why Jcenter is a better option over Maven Central, one of the primary reasons being the HTTPS transfer as a result of distribution via a CDN. Maven Central had HTTP, does the Maven repository still use HTTP?

It would make sense for them to upgrade to HTTPS, matching their competition (despite other areas where Jcenter excels). Have they done this yet?

Additionally, I'd like to ask why using a CDN enhances security. How does Maven Central distribute its libraries if not via a CDN?

Many thanks in advance.

Solution

  • HTTPS and CDN are two orthogonal concerns of a distribution repository, and JCenter and Maven Central have both.

    We (JFrog) did many experiments with CDNs (including Fastly, that Maven Central uses), and went with the widest and fastest there is on the market today – Akamai. It means that your downloads will be served from servers closer to you, and the downloads will be faster.

    But the differences aren't limited to CDN and presence or lacking of HTTPS. For example, the existence of additional metadata, like the maintainer, release notes, license information, and more is critical for a modern distribution repository, and the ability to be the owner of your package while making it available via 'canonical' repositories is also a huge advantage for open-source developers.

    I am with JFrog, the company behind , and , see my profile for details and links.