We recently started raising the minimum criteria for artifacts coming into Central:
Blind rsync transfers of random repositories are no longer being added and will be phased out over time
All artifacts must be properly signed with GPG signatures that are publicly verifiable
sources and javadocs must be included
scm urls must be included
No external repository definitions
That last one seems to cause the most commotion for users who depend on artifacts not currently in Central, and I wanted to take this opportunity to show why this is being done.
The URLs you see below are listed as RELEASE repositories found in the poms of a prominent repo we're attempting to clean for syncing to Central. In the list below, you will find some interesting bits:
Of the few repositories that actually do still work, many of them have what I would call "garbage" in them. I'll define garbage here as things that didn't originate from this project, either hacked/patched versions and/or duplicates of artifacts found somewhere else.
When you start blindly using these repos, you could get artifacts whose provenance is suspect, and your builds are slowed down because Maven is sent off on a wild goose chase. Worst case, you still have to find these repos by hand and override the bad URLs.
In the list below, I think my favorite is the dynamic search of a Fisheye repository at Atlassian.com. I'm sure they love having thousands of builds do automated searches of their Fisheye service, looking for every artifact in a build.
file://${basedir}/src/repository
file:${brillien_basedir}/../lib
file:${project.basedir}/lib
file:${project.basedir}/lib/
http://10.5.5.82:8081/artifactory/plugins-releases
http://10.5.5.82:8081/artifactory/plugins-snapshots
http://archiva.openqa.org/repository/releases/
http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/nct-core-releases
http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/nct-core-snapshots
http://artifact-repo.int.gestalt-llc.com:8080/archiva/repository/repo
http://bits.netbeans.org/maven2
http://cvs.apache.org/maven-snapshot-repository
http://developer.jasig.org/repo/content/groups/m2-legacy/
http://dist.codehaus.org/mule/dependencies/maven2
http://download.csssprites.org/maven2/
http://download.java.net/javaee5/external/shared
http://download.oracle.com/maven
http://easymock.org/maven/repository
http://egit.googlecode.com/svn/maven/snapshot-repository
http://fest.googlecode.com/svn/trunk/fest/m2/repository
http://fforw.de/m2repo/releases/
http://fisheye4.atlassian.com/browse/~raw,r=trunk/hudson/trunk/hudson/plugins/git/maven-repository
http://groovydice.sourceforge.net/m2repo
http://guiceyfruit.googlecode.com/svn/repo/releases
http://java.freehep.org/maven2
http://jets3t.s3.amazonaws.com/maven2
http://maven1.glassfishwiki.org/
http://maven.dyndns.org/2
http://maven.dyndns.org/glassfish/
http://maven.glassfish.org/content/groups/glassfish
http://maven.glassfish.org/content/groups/public/
http://maven.ocean.net.au/external
http://maven.ocean.net.au/release
http://maven.ocean.net.au/snapshot
http://maven.sfbay/mirrors/java.net
http://mirrors.ibiblio.org/pub/mirrors/maven2
http://ndeloof.free.fr/maven2
http://nexus.openqa.org/content/repositories/releases
http://oss.repository.sonatype.org/content/groups/cometd
http://people.apache.org/maven-snapshot-repository
http://people.apache.org/~mrdon/repository/
http://people.apache.org/repo/m2-incubating-repository
http://people.apache.org/repo/m2-snapshot-repository
http://people.apache.org/repo/m2-snapshot-repository/
http://repo1.maven.org/maven2
http://repo1.maven.org/maven2/
http://repo2.maven.org/maven2
http://repo2.maven.org/maven/2
http://repo.aduna-software.org/maven2/releases
http://repo.ddsteps.org/maven/release/
http://repo.nhncorp.com/maven2
http://repo.opennms.org/maven2
http://repository.codehaus.org
http://repository.ops4j.org/maven2
http://repository.ops4j.org/maven2/
http://scala-tools.org/repo-snapshots/
https://games-darkstar.dev.java.net/nonav/snapshots
https://hudson.dev.java.net/source/browse/*checkout*/hudson/hudson/main/lib
https://maven2-repository.dev.java.net/nonav/repository
https://maven2-repository.dev.java.net/nonav/repository/
https://maven-repository.dev.java.net/nonav/repository
https://maven-repository.dev.java.net/nonav/repository/
https://maven-repository.dev.java.net/repository
https://maven-repository.dev.java.net/repository/
http://snapshots.jboss.org/maven2
http://snapshots.repository.codehaus.org/
http://source.db4o.com/maven
http://sshd.googlecode.com/svn/m2-repo
http://svn.magnolia.info/maven/m2
http://svn.sonatype.org/flexmojos/repository/
http://tek42.com/maven2
http://wicketstuff.org/maven/repository
http://www.agilejava.com/maven/
http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/rt/eclipselink/maven.repo
http://www.eviware.com/repository/maven2/
http://www.ibiblio.org/maven
http://www.ibiblio.org/maven2
http://www.ibiblio.org/maven2/
http://yusuke.homeip.net/maven2
When we sync these poms to Central, it is highly likely we will simply ditch all these references. We don't take changing poms likely, but in this case it is clearly the lesser of two evils. Having the ability to leverage artifacts in some other repo is a nice fix, but once you release your project this way, you forever become a slave to that project, maintaining the repo.
To improve the experience for everyone, we are working to block this from happening in Central. We have several efforts underway to help minimize this impact, and that primarily includes making it easier to get your artifacts and third-party artifacts into Central. Stay tuned for more exciting announcements on this topic.