Maven Repository Standards

The RepoForge.io Maven repository works with mvn, Gradle, sbt / Coursier and IDE repository browsers without extra configuration.

Maven has no single formal repository standard. The repository follows the Maven repository layout and metadata model, plus the HTTP specifications below. Where clients depend on behavior that no specification defines, it matches Maven Central. Those conventions are listed separately.

Repository Format

Standard	Specification
Maven repository layout	Introduction to Repositories and Repository Layout
Repository metadata	Maven Repository Metadata Model
Gradle Module Metadata	Gradle Module Metadata specification

• Metadata: maven-metadata.xml is generated at group, artifact and SNAPSHOT version level. The group level file includes <plugins>, so mvn <prefix>:<goal> resolves plugins hosted on RepoForge.io.
• SNAPSHOTs: each deploy adds a timestamped build, and 1.0-SNAPSHOT resolves to the newest one.
• Gradle: .module files are stored and served as published.

Checksums and Signatures

• RepoForge.io generates .md5, .sha1, .sha256 and .sha512 checksums for every file.
• If your client uploads a checksum, RepoForge.io checks it against the stored file and rejects a mismatch with 400 Bad Request.
• .asc signatures and Sigstore bundles (.sigstore and .sigstore.json) are accepted for any file.

HTTP

Standard	Specification
RFC 9110	HTTP Semantics
RFC 9111	HTTP Caching
RFC 7617	The "Basic" HTTP Authentication Scheme
RFC 6750	The OAuth 2.0 Bearer Token Usage

• HEAD works on every file. Files and generated metadata carry ETag and Last-Modified, and conditional requests get 304 Not Modified, so Gradle and IDEs can revalidate their caches cheaply.
• Files are served with a Content-Type that matches their type, such as application/xml for POMs.
• Unauthenticated requests to a private repository get 401 Unauthorized with a WWW-Authenticate: Basic realm="RepoForge.io" challenge.
• Authenticate with an access token as the password of HTTP Basic auth, or send it as Authorization: Bearer <token>, as Gradle's HttpHeaderCredentials and Maven 3.9's httpHeaders do.

Ecosystem Conventions

These aren't in a specification. They match how Maven Central and common repository managers behave:

• Release versions are immutable. Uploading a file that already exists under a release version returns 409 Conflict, as on Maven Central. SNAPSHOT versions aren't affected.
• SNAPSHOT retention. The 10 newest builds of each SNAPSHOT version are kept.
• Version order. <latest> and <release> in maven-metadata.xml follow Maven's version order, not publish time, so deploying a 1.x hotfix after 2.0.0 doesn't change <release>.
• Accepted file types. Uploads are limited to the extensions listed in Allowed file types. Anything else is rejected with 400 Bad Request.
• Directory index pages. Repository, artifact and version paths return an HTML index of the files and directories the caller can read.
• Path segments. ., .. and empty path segments are rejected.
• Missing prefix files. .meta/prefixes.txt, which Maven 3.9 requests, returns 404 Not Found, so Maven falls back to checking artifacts individually.
• Private repositories don't reveal artifact names. Unauthenticated requests get 401 whether or not the path exists. Repositories with public artifacts return 404 for missing paths, so builds that list RepoForge.io ahead of Maven Central keep resolving.

For publishing and resolving, see Using Maven and Gradle with RepoForge.io.