Configuring Maven

Point Maven at the Seal Artifact Server using pom.xml and settings.xml.

Maven needs the Seal Artifact Server declared as a repository in pom.xml and its credentials supplied in the Maven settings file (~/.m2/settings.xml on Unix or %userprofile%\.m2\settings.xml on Windows).

Configuration

Step 1: Add the repository to pom.xml

Open the project's pom.xml. If there is no <repositories> block, add one. Place the Seal repository first so Maven consults it before falling back to other remotes:

<repositories>
  <repository>
    <id>seal-security</id>
    <url>https://maven.sealsecurity.io/</url>
  </repository>
</repositories>

The <id>seal-security</id> value links this entry to its credentials in the settings file. Keep them aligned.

Step 2: Add credentials to settings.xml

Open Maven's settings file. Add a <server> entry whose <id> matches the repository entry above:

<settings>
  <servers>
    <server>
      <id>seal-security</id>
      <username>${env.SEAL_PROJECT}</username>
      <password>${env.SEAL_TOKEN}</password>
    </server>
  </servers>
</settings>

The ${env.SEAL_PROJECT} and ${env.SEAL_TOKEN} placeholders read from the build environment, which keeps the credentials out of version-controlled files.

Step 3: Set the environment variables when building

SEAL_PROJECT=<project-id> SEAL_TOKEN=<token> mvn package

In CI, set the two variables once at the job level rather than per command.

Verify

A clean build that resolves at least one dependency should pull from https://maven.sealsecurity.io/. Run with -X (debug) to see the resolved-from URL in the output if you want to confirm explicitly.

Related

• Maven-specific server features: +safest, +safest-until-<cutoff>, and the redirect policy for non-sealed artifacts.

• Editing dependency files manually: pinning sealed versions in pom.xml, with the <dependencyManagement> block for transitive overrides.

• Configuring Gradle: the JVM-ecosystem equivalent for Gradle builds.