From mobile apps to microservices, from small startups to big enterprises, Gradle helps teams build, automate and deliver better software, faster.

Gradle Community

<https://central.sonatype.org/publish/maven-central-publishing-limits/>

Would be nice to a solution where the metadata only is centralized and the hosting costs are decentralized and passed down to the publisher

I don't mind paying a few dollars for my projects storage

&gt; [...] the hosting costs are decentralized and passed down to the publisher
&gt; 
Wouldn't that increase the attack surface for potential supply chain attacks?

The metadata would have the signatures. If you trust the metadata, then you're fine

That requires everyone to use dependency verification of course

That's where Gradle comes in. They'd need to steer users towards dependency verification by default

And probably update the DX, the <https://docs.gradle.org/current/userguide/dependency_verification.html|current docs> are very detailed but also a bit overwhelming TBH