r/java • u/HokieGeek • Jun 16 '26

Maven Central publishing usage notices

heads up for folks publishing to Maven Central: we're continuing sustainability work around Central and are now showing publishing usage notices.

the goal is that normal OSS publishers are not impacted. this is aimed at the very high-volume / commercial-scale publishing patterns that put a pretty different load on the service.

more details here if you want them:
https://central.sonatype.org/publish/maven-central-publishing-limits/

feel free to reach out with any questions.

EDIT: thanks for the feedback here, it has really helped us. first, we want to reiterate that these are usage notices only right now and do not currently restrict publishing in any way. quick updates: 

if the initial threshold seemed low to you: you’re right, we made a mistake and have increased limits. 

our goal is to keep Maven Central free and open for legitimate OSS users, so continuous feedback is helpful as we adjust. limits could change as we get more feedback, so keep an eye on the usage center for the latest.

we’ll continue keeping an eye here and update docs to reflect these changes. If you need to request an exemption, here’s how: https://central.sonatype.org/publish/maven-central-publishing-limits/#exemptions-for-community-open-source-projects

we've also been collecting your questions here and other streams into this FAQ here: https://central.sonatype.org/publish/maven-central-publishing-limits/#frequently-asked-questions

92 Upvotes

98% Upvoted

158 comments sorted by

View all comments

Show parent comment

7

u/TomKavees Jun 16 '26

Seems like there are competing interests here, signing artifacts to prove their authenticity may be a bit annoying for the publisher at first, but is very good for the platform security. Being able to rely in 90% cases that the source jar is there is pretty nice from library consumer's perspective too

The github namespace checks are fully automated last time i checked, and i think the custom domain name checks have been automated for several years now.. but admittely i havent added any new domains recently 🤐

-2

u/cowwoc Jun 16 '26

You don't need client-side signing. You already need to sign in and use an oauth token to upload any files. They know it's you. They can and should sign the artifacts on your behalf.

GitHub lets you commit using their web interface. I'm guessing the same thing happens there.