Java on

Chainguard Libraries for Java overview

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Java provides enhanced security for the Java ecosystem by rebuilding dependencies from Maven Central and other common repositories with the latest patches and comprehensive supply chain protection. This service addresses critical vulnerabilities in the vast Java/JVM ecosystem that spans hundreds of projects from organizations like the Apache Software Foundation, Eclipse Foundation, and numerous independent maintainers.

Chainguard Libraries for Java provides access to all open source libraries commonly used. New releases of common libraries or artifacts requested by customers are added to the growing index by an automated system. The number of included libraries continues to grow. These artifacts are accessible through the Chainguard Repository, a single endpoint for package retrieval that supports configurable security policies for both Chainguard-built and upstream packages.

Global configuration

Tue, 25 Mar 2025 08:04:00 +0000

Java and JVM library consumption in a large organization is typically managed by a repository manager. Commonly used repository manager applications are Cloudsmith, Google Artifact Registry, JFrog Artifactory, and Sonatype Nexus Repository. The repository manager acts as a single point of access for developers and development tools to retrieve the required libraries.

The recommended approach is to use the upstream fallback feature of Chainguard Repository, which allows you to configure your repository manager with a single upstream pointed at https://libraries.cgr.dev/java/ without a separate fallback to Maven Central. The Chainguard Repository handles fallback and policy enforcement; your repository manager handles local caching and access control. Chainguard retrieves packages from the public Maven Central repository on your behalf when upstream fallback is enabled. This includes protections such as malware scanning and a cooldown period for newly published packages.

Build configuration

Tue, 25 Mar 2025 08:04:00 +0000

The configuration for the use of Chainguard Libraries depends on your build tools, continuous integration, and continuous deployment setups

At a high level adopting the use of Chainguard Libraries consists of the following steps:

Remove local caches on workstations and CI/CD pipelines. This step ensures that any libraries that were already sourced from other repositories are requested again and the version from Chainguard Libraries is used instead of other binaries.
Change configuration to access Chainguard Libraries via your repository manager after the changes from the global configuration are implemented.

These changes must be performed on all workstations of individual developers and other engineers running relevant application builds. They must also be performed on any build server such as Jenkins, TeamCity, GitHub or other infrastructure that builds the applications or otherwise downloads and uses relevant libraries.

Management and maintenance

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Java operates transparently after completing the global configuration and build configuration, automatically providing security-enhanced versions of your Maven dependencies. New artifacts and versions are retrieved from Chainguard’s hardened repository when available, while Maven Central and other configured repositories provide fallback access to ensure continuous development workflow without interruption.

The following sections detail optional management, maintenance, and auditing steps on the repository manager and the build tool.

Source verification

Use chainver to verify that a specific library or file originates from Chainguard in an automated fashion or follow the steps in this section for manual verification.

Migrating a Java project to Chainguard Libraries

Thu, 02 Jul 2026 00:00:00 +0000

Chainguard Libraries for Java provides a curated repository of packages rebuilt from upstream sources and scanned for malware. Because Chainguard Libraries uses the standard Maven repository format, switching an existing project requires only a repository configuration change — no changes to your application code or dependency versions.

This guide walks through migrating an existing Java project to Chainguard Libraries, covering the two most common setups:

Direct access — your build tool connects directly to libraries.cgr.dev. This option is faster for initial evaluation and smaller-scale setups.
Repository manager — your build tool connects to a repository manager (Cloudsmith, Google Artifact Registry, JFrog Artifactory, or Sonatype Nexus), which proxies requests to Chainguard Libraries.

Prerequisites

Before you begin, you need: