FAQ | This is a LIVE service | Changelog

Investigate options for using GitLab Package Registry as a local proxy/mirror for Maven Central and other remote Maven repos

As a possible work around / alternative solution to #101 (closed) we'd like to know if it's possible to use GitLab Package Registry as a local mirror for Java jar dependencies that we pull from remote repos like Maven Central when we build.

In addition to potentially avoiding the 'Connection Reset' issue that may not be easily fixable, it may also give us additional security benefits of avoiding potential supply chain attacks if we no longer need to pull dependencies from a remote repo.

The docs imply this feature is available, but rather than enabling and causing unexpected disk usage issues we'd like to know if it's possible for us to turn this on (at least for HR projects).

Another reason to enable this feature is to avoid other random 403 errors when retrieving dependencies from some remote Maven repos, such as sourceforge.net seen on this failing job.

Edited by Kevin Hooke