OSS + ELC EU 2026

Modern software projects depend on hundreds of third-party libraries, making reproducible and secure builds increasingly difficult. However, Maven, one of the most widely used Java build tools, has no native lockfile support. This leaves projects exposed to version drift, tampered artifacts, and dependency confusion attacks, while making hermetic builds difficult to achieve.

Maven-lockfile addresses this by generating a cryptographic record of all resolved artifacts, including transitive dependencies, and validating them on every build. This enables frozen dependency sets for exact historical reproducibility. In collaboration with Red Hat, we extended maven-lockfile to systematically capture build extensions, BOMs, and other dynamically fetched artifacts required for hermetic builds, and compare it against Maven-native approaches like Trusted Checksums.

To complete the workflow, we demo maven-lockfile alongside Hermeto, a CLI tool that pre-fetches dependencies into a local cache, enabling fully network-isolated builds.