Currently, Maven repositories follow a problematic centralised model. For example, the integrity of the software artifacts is checked by using digests that are located on the same directory as the artifact itself. Given that the verification of digital signatures currently implies additional work by the user, the vast majority of builds never check those signatures and rely on the digests.
This proposal describes how the implementers of Maven clients and repository managers could use a multi-repository model, which would give more choice to users while improving security.
This proposal only applies to releases, not snapshots. The basic idea is to deploy release artifacts to multiple repositories, then put the URLs of the other servers as metadata in the groupId/artifactId directory of each repository, and later use the additional Maven servers for increased reliability (e.g. using digests coming from a different server than the artifact).
This proposal is backwards-compatibl