Store the credentials in settings.xml

Add a server entry to ~/.m2/settings.xml (on Windows, %USERPROFILE%\.m2\settings.xml). The id is the name that pom.xml refers to; the examples use repsy.

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
  http://maven.apache.org/xsd/settings-1.0.0.xsd">

  <servers>
    <server>
      <id>repsy</id>
      <username>MY REPSY USERNAME</username>
      <password>MY REPSY PASSWORD OR DEPLOY TOKEN</password>
    </server>
  </servers>
</settings>

In a CI job, read the secret from an environment variable instead of writing it into the file: <password>${env.REPSY_DEPLOY_TOKEN}</password>.

Point the project at the repository

Add the repository to the distributionManagement section of pom.xml. Maven deploys a release version to repository and a version that ends in -SNAPSHOT to snapshotRepository, so define both:

<project>
  <groupId>com.example</groupId>
  <artifactId>demo</artifactId>
  <version>1.0.0</version>
  <packaging>jar</packaging>

  <distributionManagement>
    <repository>
      <id>repsy</id>
      <name>Repsy Open Source</name>
      <url>https://<your-repsy-host>/<repo-name></url>
    </repository>
    <snapshotRepository>
      <id>repsy</id>
      <name>Repsy Open Source</name>
      <url>https://<your-repsy-host>/<repo-name></url>
    </snapshotRepository>
  </distributionManagement>
</project>

Publish a release version

mvn deploy

Maven uploads the POM and the jar (and the sources and javadoc jars, if the build attaches them), each with its checksums, and then the maven-metadata.xml files. The build ends with BUILD SUCCESS.

Deploying the same release version again works when the repository’s Package Override setting is Allow, which is the default of a new repository. When it is Deny, Repsy refuses the second deploy on its first file with 403 and changes nothing, see Maven Upload Rules.

Publish a SNAPSHOT version

Give the project a version that ends in -SNAPSHOT, for example 1.1.0-SNAPSHOT, and run mvn deploy again. Maven uploads timestamped files such as demo-1.1.0-20260925.101010-1.jar and a version-level maven-metadata.xml that points to the newest build.

Every deploy of a SNAPSHOT writes new timestamped files, so it is never an override: you can deploy the same SNAPSHOT as often as you like, also when Package Override is Deny.

If the Version Allowance setting of the repository is releases, SNAPSHOT versions are refused, and snapshots refuses release versions.

Consume the artifact

In the project that uses the library, add the repository and the dependency to pom.xml:

<project>
  <repositories>
    <repository>
      <id>repsy</id>
      <name>Repsy Open Source</name>
      <url>https://<your-repsy-host>/<repo-name></url>
    </repository>
  </repositories>

  <dependencies>
    <dependency>
      <groupId>com.example</groupId>
      <artifactId>demo</artifactId>
      <version>1.0.0</version>
    </dependency>
  </dependencies>
</project>

A private repository needs the same server entry (with the id repsy) in settings.xml as for publishing. A public repository can be read without credentials. Then run:

mvn compile

A -SNAPSHOT dependency resolves to the newest timestamped build through the version-level metadata. Maven checks for a newer build once a day by default; run mvn -U compile to check right away.

To test that Repsy really serves the artifact, without a project and without your local repository, resolve it directly:

mvn dependency:get -Dartifact=com.example:demo:1.0.0 \
  -DremoteRepositories=repsy::default::https://<your-repsy-host>/<repo-name>

The repsy in remoteRepositories is the id that selects the server entry of settings.xml.

Verify the result in the web UI

1. Sign in to the web UI and open the Repositories tab. Open your repository.
2. The list has one row per artifact, with its group, its artifact ID and its latest version. Open the artifact to see its versions, and open a version to see the POM and ready-made dependency snippets for Apache Maven, Gradle and other build tools.
3. Browse Files shows the stored files as a directory tree, with the POM, the jar, the checksums and the maven-metadata.xml files.
4. The Signed field of a version shows whether the version has verified PGP signatures, see Signing Maven Artifacts.

A version shows up in the list when its POM has been uploaded.