So let's get the first step of never looking to external repositories. Is this something that can be enforced at the project pom level, or does the user settings always allow for an override of the repo? A feature request we had from the start was to go a step further and allow a project to only load from signed repositories. I know Ruel brought this up in the maven dev lists and there was some interest, but I don't think any progress has been made. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4032862#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...