# Repository Types

version 9.2.0-branch-sigushkinDeclarativeComposability-20250818215312+0000

Gradle supports various sources for resolving dependencies, accommodating different metadata formats and connectivity methods. You can resolve dependencies from:

- Maven-compatible artifact repositories (e.g., Maven Central)

- Ivy-compatible artifact repositories (including custom layouts)

- Local (flat) directories

## Maven repositories

Many organizations host dependencies in Maven repositories. Gradle can declare Maven repositories by specifying their URL:

build.gradle.kts

    repositories {
        maven {
            url = uri("http://repo.mycompany.com/maven2")
        }
    }

build.gradle

    repositories {
        maven {
            url = "http://repo.mycompany.com/maven2"
        }
    }

### Composite Maven repository

Sometimes, POMs are published in one location, and JARs in another. You can define such a repository as follows:

build.gradle.kts

    repositories {
        maven {
            // Look for POMs and artifacts, such as JARs, here
            url = uri("http://repo2.mycompany.com/maven2")
            // Look for artifacts here if not found at the above location
            artifactUrls("http://repo.mycompany.com/jars")
            artifactUrls("http://repo.mycompany.com/jars2")
        }
    }

build.gradle

    repositories {
        maven {
            // Look for POMs and artifacts, such as JARs, here
            url = "http://repo2.mycompany.com/maven2"
            // Look for artifacts here if not found at the above location
            artifactUrls "http://repo.mycompany.com/jars"
            artifactUrls "http://repo.mycompany.com/jars2"
        }
    }

Gradle will first look for POMs and artifacts at the base URL, and if the artifact is not found, it will check the additional `artifactUrls`.

### Strict limitation for Maven repositories

Maven POM metadata can specify additional repositories, but Gradle ignores them. Instead, Gradle strictly uses only the repositories declared in the build script.

| This serves as both a reproducibility safeguard and a security measure. Without this restriction, an updated dependency version could unexpectedly introduce artifacts from unverified sources into your build.

### Authenticated Maven repository

You can specify credentials for Maven repositories that require authentication. See Supported Repository Protocols for authentication options.

### Local Maven repository

Gradle can consume dependencies from a local Maven repository, that is repositories on the local file system:

build.gradle.kts

    repositories {
        maven {
            url = uri(layout.buildDirectory.dir("repo"))
        }
    }

build.gradle

    repositories {
        maven {
            url = uri(layout.buildDirectory.dir("repo"))
        }
    }

Gradle can consume dependencies from the local Maven repository. This is useful for teams that want to test their setup locally before publishing their plugin.

You should ensure that using the local Maven repository is necessary before adding `mavenLocal()` to your build script:

build.gradle.kts

    repositories {
        mavenLocal()
    }

build.gradle

    repositories {
        mavenLocal()
    }

| Gradle manages its own cache and doesn’t need to declare the local Maven repository even if you resolve dependencies from a remote Maven repository.

Gradle uses the same logic as Maven to identify the location of your local Maven cache. If a `settings.xml` file is defined in the user’s home directory (`~/.m2/settings.xml`), this location takes precedence over `M2_HOME/conf` Otherwise, Gradle defaults to `~/.m2/repository`.

#### The case against `mavenLocal()`

As a general rule, you should avoid adding `mavenLocal()` as a repository in your Gradle builds. There are several issues with relying on it:

1. Not a true repository, just a cache:

   - Maven treats `mavenLocal()` as a cache, not a reliable repository.

   - It may contain incomplete modules—for example, missing sources or Javadoc files—leading to issues in Gradle when resolving dependencies.

2. Trust and security issues

   - Gradle does not trust local repositories because artifacts’ origins cannot be verified.

   - Dependencies can be easily overwritten, creating risks for security, correctness, and reproducibility.

3. Performance degradation

   - Since metadata and artifacts can change at any time (see item 2), Gradle disables caching for local repositories.

   - This results in slower builds—especially when `mavenLocal()` is declared before remote repositories, as Gradle checks it first.

Despite its drawbacks, there are rare cases where `mavenLocal()` can be useful:

1. Interoperability with Maven:

   - Example: If Project A (Maven) and Project B (Gradle) share artifacts during development, `mavenLocal()` can act as a temporary bridge.

   - Prefer an internal repository instead, but if that’s not feasible, limit `mavenLocal()` to local builds only.

2. Interoperability with Gradle (Multi-Repo Development):

   - Example: If you need to validate that Project A’s changes work with Project B, `mavenLocal()` might be used.

   - Prefer composite builds for better dependency resolution.

   - Only use `mavenLocal()` as a last resort.

To mitigate risks, consider restricting `mavenLocal()` to specific dependencies using a repository filter:

    repositories {
        mavenLocal {
            content {
                includeGroup("com.example.myproject") // Only allow this group from mavenLocal
            }
        }
    }

This ensures that `mavenLocal()` is only used for expected dependencies and avoids unexpected resolution issues.

## Ivy repositories

Many organizations host dependencies in Ivy repositories.

### Standard layout Ivy repository

To declare an Ivy repository with the standard layout, simply specify the URL:

build.gradle.kts

    repositories {
        ivy {
            url = uri("http://repo.mycompany.com/repo")
        }
    }

build.gradle

    repositories {
        ivy {
            url = "http://repo.mycompany.com/repo"
        }
    }

### Named layout Ivy repository

You can specify that your repository follows the Ivy default layout:

build.gradle.kts

    repositories {
        ivy {
            url = uri("http://repo.mycompany.com/repo")
            layout("maven")
        }
    }

build.gradle

    repositories {
        ivy {
            url = "http://repo.mycompany.com/repo"
            layout "maven"
        }
    }

Valid named layout values are `gradle` (default), `maven`, and `ivy`. Refer to IvyArtifactRepository.layout(java.lang.String) in the API documentation for more details.

### Custom pattern layout Ivy repository

To define an Ivy repository with a non-standard layout, you can set up a pattern layout:

build.gradle.kts

    repositories {
        ivy {
            url = uri("http://repo.mycompany.com/repo")
            patternLayout {
                artifact("[module]/[revision]/[type]/[artifact].[ext]")
            }
        }
    }

build.gradle

    repositories {
        ivy {
            url = "http://repo.mycompany.com/repo"
            patternLayout {
                artifact "[module]/[revision]/[type]/[artifact].[ext]"
            }
        }
    }

For an Ivy repository that fetches Ivy files and artifacts from different locations, define separate patterns:

build.gradle.kts

    repositories {
        ivy {
            url = uri("http://repo.mycompany.com/repo")
            patternLayout {
                artifact("3rd-party-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
                artifact("company-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
                ivy("ivy-files/[organisation]/[module]/[revision]/ivy.xml")
            }
        }
    }

build.gradle

    repositories {
        ivy {
            url = "http://repo.mycompany.com/repo"
            patternLayout {
                artifact "3rd-party-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
                artifact "company-artifacts/[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
                ivy "ivy-files/[organisation]/[module]/[revision]/ivy.xml"
            }
        }
    }

Optionally, you can enable Maven-style layout for the 'organisation' part, with forward slashes replacing dots:

build.gradle.kts

    repositories {
        ivy {
            url = uri("http://repo.mycompany.com/repo")
            patternLayout {
                artifact("[organisation]/[module]/[revision]/[artifact]-[revision].[ext]")
                setM2compatible(true)
            }
        }
    }

build.gradle

    repositories {
        ivy {
            url = "http://repo.mycompany.com/repo"
            patternLayout {
                artifact "[organisation]/[module]/[revision]/[artifact]-[revision].[ext]"
                m2compatible = true
            }
        }
    }

### Authenticated Ivy repository

You can specify credentials for Ivy repositories that require authentication. See Supported Repository Protocols for authentication options.

### Local Ivy repository

Gradle can consume dependencies from a local Ivy repository, that is repositories on the local file system:

build.gradle.kts

    repositories {
        ivy {
            // URL can refer to a local directory
            url = uri("../local-repo")
        }
    }

build.gradle

    repositories {
        ivy {
            // URL can refer to a local directory
            url = file("../local-repo")
        }
    }

## Flat directory repository

Some projects store dependencies on a shared drive or within the project’s source code rather than using a binary repository. To use a flat filesystem directory as a repository, you can configure it like this:

build.gradle.kts

    repositories {
        flatDir {
            dirs("lib")
        }
        flatDir {
            dirs("lib1", "lib2")
        }
    }

build.gradle

    repositories {
        flatDir {
            dirs 'lib'
        }
        flatDir {
            dirs 'lib1', 'lib2'
        }
    }

This configuration adds repositories that search specified directories for dependencies.

| Flat directory repositories are discouraged, as they do not support metadata formats like Ivy XML or Maven POM files.

In general, binary dependencies should be sourced from an external repository, but if storing dependencies externally is not an option, prefer declaring a Maven or Ivy repository using a local file URL instead.

When resolving dependencies from a flat dir repo, Gradle dynamically generates adhoc dependency metadata based on the presence of artifacts. Gradle prefers modules with real metadata over those generated by flat directory repositories. For this reason, flat directories cannot override artifacts with real metadata from other declared repositories.

For instance, if Gradle finds `jmxri-1.2.1.jar` in a flat directory and `jmxri-1.2.1.pom` in another repository, it will use the metadata from the latter.