a private Maven repository that remembers
Swap one URL in settings.xml, or a Gradle repositories block,
and builds flow through gastropod: a caching proxy for Maven Central, hosted repositories
for internal artifacts, and a registry that can answer, on the day it matters, exactly
where every JAR lives and who pulled it there.
connecting is as easy as
<!-- settings.xml --> <repository> <id>gastropod</id> <url>https://gastropod.io/maven/</url> </repository>
Maven and Gradle both speak the same repository layout, so one URL serves both.
what happens on every resolve
- Identity is fixed. The artifact resolves to an exact PURL (group, artifact, version) and sha256 digest: coordinates plus a fact, not just coordinates.
- Integrity is checked at intake, against the repository's published checksums, with Sigstore attestations checked where publishers provide them.
- Advisories are correlated. Known OSV advisories attach to the exact version, and critically for the JVM world, to everything downstream through the transitive graph.
- The pull is recorded. Which principal resolved it, when, and from where, on the audit spine and exportable.
- It's remembered. SBOM, findings, provenance, and dependents stay on the digest; every later resolve inherits them.
the log4j weekend
December 2021 didn't hurt because log4j was obscure. It hurt because it
was everywhere, and almost nobody could say where. The JVM's transitive dependency graph
meant log4j-core sat eight levels deep in applications whose teams had never
typed its name. The industry spent that weekend, and weeks after, grepping build outputs and
unpacking JARs to answer one question: where is it, and what do we ship that contains it?
That question is what gastropod answers before it's asked. Every artifact resolved through
it lands in the blast-radius graph, direct and transitive dependents flattened into
queryable edges, with pull history attributing every fetch. When the next log4j-class
advisory drops, the affected digest shows every package, application, and consumer in
reach, in minutes, not a weekend.
proxy, hosted, virtual
proxy
A caching mirror of Maven Central, or any upstream. The first resolve fetches and verifies into content-addressed, deduplicated storage.
hosted
Internal artifacts, deployed with standard
mvn deploy or a Gradle publish, token-gated with reader and publisher
roles.
virtual
One URL aggregating both, so settings.xml
needs exactly one entry.
Every feature is on every tier: OIDC SSO, scoped tokens, CycloneDX SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
does one repository URL work for both Maven and Gradle?
Yes. Gradle consumes Maven-layout repositories natively, so the same
gastropod URL goes in settings.xml for Maven and the repositories block for
Gradle.
can I deploy internal artifacts?
Yes. A hosted repository accepts standard mvn deploy (and
Gradle's maven-publish), keeps artifacts private by default, and enforces
reader and publisher roles per token.
how does gastropod help with transitive dependencies?
Every resolved artifact lands in a blast-radius graph of direct and transitive dependents. When an advisory hits a deep dependency, the graph shows every artifact and consumer downstream of it, the log4j question answered from a query instead of a grep.
can it replace Nexus or Artifactory for Maven?
For standard Maven and Gradle workflows, yes. It's a URL and credentials change, and it runs side by side with your current repository manager during evaluation. See the Nexus comparison.
does it proxy repositories other than Maven Central?
Yes. Proxy repositories can front other Maven-layout upstreams, with each cached artifact verified and deduplicated the same way.
Part of the full product overview. Also speaking: npm · OCI.
Maven is a trademark of the Apache Software Foundation. Gradle is a trademark of Gradle, Inc. Gastropod is not affiliated with either. Details current as of July 2026.