The problem is that you normally cannot find a path to the developers through the web of trust, of course, but that's not Maven's fault. It is Maven's vault. D

The problem is that you normally cannot find a path to the developers through the web of trust, of course, but that's not Maven's fault. It is Maven's vault. Debian could have taken the same approach, but instead they have decided to vet prospective developers for a few years, and use one signing key for package indexes. As a result, in Debian: - It is feasible to actually check packages, because you don't need a large WoT. - You know that the maintainer of a package was a least vetted for some time before they could put anything in the archive. With Maven: - It's infeasible to check the signatures, since nearly no one has a complete enough WoT. - Anyone can submit a library, no vetting necessary. - Maven does not check signatures by default. So, basically the only thing you can do in Maven is hand-pick a small set of libraries. Verify them in some way and stick to specific versions, putting their checksums in your POM. Unfortunately, as the article already touches upon, too many Java libraries pull in half of the internet, so it may not be very practical.