# Migrating a Java project to Chainguard Libraries

URL: https://chainguard-docs-preview-git-athena-mention.chainguard.app/chainguard/libraries/java/migration.md
Last Modified: September 28, 2026
Tags: Chainguard Libraries, Java

How to migrate an existing Java project to pull dependencies from Chainguard Libraries


Chainguard Libraries for Java provides a curated repository of packages rebuilt from upstream sources and [scanned for malware](/chainguard/libraries/introduction/overview/#malware-and-greyware-detection). Because Chainguard Libraries uses the standard Maven repository format, switching an existing project requires only a repository configuration change — no changes to your application code or dependency versions.

This guide walks through migrating an existing Java project to Chainguard Libraries, covering the two most common setups:

- Direct access — your build tool connects directly to libraries.cgr.dev. This option is faster for initial evaluation and smaller-scale setups.
- Repository manager — your build tool connects to a repository manager ([Cloudsmith](/chainguard/libraries/java/global-configuration/#cloudsmith), [Google Artifact Registry](/chainguard/libraries/java/global-configuration/#google-artifact-registry), [JFrog Artifactory](/chainguard/libraries/java/global-configuration/#jfrog-artifactory), or [Sonatype Nexus](/chainguard/libraries/java/global-configuration/#sonatype-nexus-repository)), which proxies requests to Chainguard Libraries.

To follow along with a ready-made project instead of your own, use the [Chainguard Libraries for Java demo repository](https://github.com/chainguard-demo/chainguard-libraries-java). It provides Maven and Gradle example projects, including a minimal Spring Boot application and CVE remediation demos.

For a reference of the configuration options for each supported build tool, check out [Configure Java build tools](/chainguard/libraries/java/build-configuration/).

## Prerequisites

Before you begin, you need:

- An existing Java project
- [`chainctl` installed and authenticated](/platform/chainctl-usage/how-to-install-chainctl/)

### Create an entitlement

You must have an [entitlement to Chainguard Libraries](/platform/chainctl/chainctl-docs/chainctl_libraries_entitlements_create/) for Java with [upstream fallback](/chainguard/libraries/introduction/overview/#upstream-fallback-and-controls) enabled.

To create an entitlement to Chainguard Libraries for Java and enable upstream fallback, which includes a default 7-day cooldown, run the following command:

```shell
chainctl libraries entitlements create --ecosystems=JAVA --policy=CHAINGUARD_AND_UPSTREAM
```

Alternatively, you can create an entitlement in the Chainguard Console: while viewing the Java ecosystem page, follow the prompts to create an access token.

You can also configure cooldown policies after you create the entitlement. For example, to create and enforce a policy that disables the cooldown:

```shell
chainctl libraries policy create --name=java-disable-cooldown --cooldown-days=0
chainctl libraries policy enable java-disable-cooldown --ecosystem=JAVA --mode=ENFORCE
```

It can take up to 30 minutes for the fallback and cooldown policies to take effect. Learn more about cooldown and other policies in the [Libraries policies documentation](/chainguard/chainguard-repository/library-policies/).

> **Note**: If you choose to manage your own fallback to upstream repositories, refer to the following docs pages for more information: [Build configuration](/chainguard/libraries/java/build-configuration/) for direct access instructions or [Global configuration](/chainguard/libraries/java/global-configuration/) for repo manager instructions. Note that configuring a public fallback bypasses the protections provided by Chainguard.

## Step 1: Confirm your baseline build

Before making any changes, confirm your project builds cleanly against Maven Central.



**Maven**

<pre class="highlight" data-language="shell"><code class="language-shell" data-lang="shell">cd your-project
./mvnw install</code></pre>


**Gradle**

<pre class="highlight" data-language="shell"><code class="language-shell" data-lang="shell">cd your-project
./gradlew build</code></pre>


**Bazel**

<pre class="highlight" data-language="shell"><code class="language-shell" data-lang="shell">cd your-project
bazel build //...</code></pre>





All dependencies should download from Central and tests should pass. This gives you a baseline to compare against after migration.

## Step 2: Generate a pull token

You must be an Owner or have the `libraries.java.pull_token_creator` permission to create a pull token.
You can [create a pull token in the Chainguard Console](/chainguard/libraries/introduction/access/#creating-pull-tokens-with-the-chainguard-console), or via `chainctl`.

The following command creates the token and populates environment variables directly. If you have access to more than one Chainguard organization, add `--parent=<organization>` to choose which one the token belongs to:

```shell
eval $(chainctl auth pull-token --repository=java --name=my-java-token --output=env)
```

This results in values for the `CHAINGUARD_JAVA_IDENTITY_ID` and `CHAINGUARD_JAVA_TOKEN` variables. The token is named `my-java-token`, with a default expiration of 30 days. To configure the expiration, use the `--ttl` flag.

Learn more about command options in the [chainctl documentation](/platform/chainctl/chainctl-docs/chainctl_auth_pull-token/).

When configuring direct access, note that environment variables do not persist between terminal sessions. You must re-export them each time you open a new terminal, or add them to your shell profile. Learn more about pull tokens in the [Access documentation](https://edu.chainguard.dev/chainguard/libraries/introduction/access/).

### Do not commit credentials to version control

The Gradle `build.gradle` file and the Maven `pom.xml` are typically committed to a repository — always use environment variables for credentials rather than hardcoding token values directly in the file. Maven credentials live in `~/.m2/settings.xml`, which is outside the project directory and not committed by default, but take care not to add it to your repository. Store tokens as CI secrets referenced via environment variables instead. If you accidentally commit credentials, [delete the exposed token](/chainguard/libraries/introduction/access/#pull-token-management).

For more secure credential management, consider using a secrets manager such as 1Password CLI or Bitwarden, which can dynamically inject environment variables at runtime without storing token values in shell profiles or env files.

### Verify your setup

Run the following command for a connectivity and authentication check:

```bash
curl -u "$CHAINGUARD_JAVA_IDENTITY_ID:$CHAINGUARD_JAVA_TOKEN" \
  https://libraries.cgr.dev/java/
```

The command returns an HTML page listing repository directories. If credentials are invalid or expired, the command returns a 403 error instead of the directory listing.

## Step 3: Configure repository access

The `https://libraries.cgr.dev/java/` endpoint is also the [Chainguard Repository](/chainguard/chainguard-repository/overview/) endpoint for Java. By default, it serves only Chainguard-built artifacts. When upstream fallback is enabled for your organization, the same endpoint can also serve requested versions from Maven Central under Chainguard security controls.

### Direct access



**Maven**

<p>Maven repository and credentials configuration lives in a <code>settings.xml</code> file. For a project-local setup, place this file in the <code>.mvn</code> folder of your project and pass <code>-s .mvn/settings.xml</code> when running Maven commands.</p>
<p>First, create a <code>.mvn</code> directory if it doesn&rsquo;t already exist:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">mkdir -p .mvn</code></pre><p>Next, create a <code>.mvn/settings.xml</code> file with the following content. This configuration sets the Chainguard <a href="/chainguard/libraries/policies-and-security/cve-remediation/">remediated repository</a> as the first source, followed by the standard Chainguard repository, with Maven Central set as <code>invalid</code> to avoid accidental unintended fallback to the public repository:</p>
<pre class="highlight" data-language="xml"><code class="language-xml" data-lang="xml">&lt;settings&gt;
  &lt;servers&gt;
    &lt;server&gt;
      &lt;id&gt;chainguard-remediated&lt;/id&gt;
      &lt;username&gt;${env.CHAINGUARD_JAVA_IDENTITY_ID}&lt;/username&gt;
      &lt;password&gt;${env.CHAINGUARD_JAVA_TOKEN}&lt;/password&gt;
    &lt;/server&gt;
    &lt;server&gt;
      &lt;id&gt;chainguard&lt;/id&gt;
      &lt;username&gt;${env.CHAINGUARD_JAVA_IDENTITY_ID}&lt;/username&gt;
      &lt;password&gt;${env.CHAINGUARD_JAVA_TOKEN}&lt;/password&gt;
    &lt;/server&gt;
  &lt;/servers&gt;

  &lt;profiles&gt;
    &lt;profile&gt;
      &lt;id&gt;chainguard&lt;/id&gt;
      &lt;repositories&gt;
        &lt;repository&gt;
          &lt;id&gt;chainguard-remediated&lt;/id&gt;
          &lt;url&gt;https://libraries.cgr.dev/java-remediated/&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/repository&gt;
        &lt;repository&gt;
          &lt;id&gt;chainguard&lt;/id&gt;
          &lt;url&gt;https://libraries.cgr.dev/java/&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/repository&gt;
        &lt;repository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;https://invalid&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/repository&gt;
      &lt;/repositories&gt;

      &lt;pluginRepositories&gt;
        &lt;pluginRepository&gt;
          &lt;id&gt;chainguard-remediated&lt;/id&gt;
          &lt;url&gt;https://libraries.cgr.dev/java-remediated/&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/pluginRepository&gt;
        &lt;pluginRepository&gt;
          &lt;id&gt;chainguard&lt;/id&gt;
          &lt;url&gt;https://libraries.cgr.dev/java/&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/pluginRepository&gt;
        &lt;pluginRepository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;https://invalid&lt;/url&gt;
          &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/pluginRepository&gt;
      &lt;/pluginRepositories&gt;

    &lt;/profile&gt;
  &lt;/profiles&gt;
  &lt;activeProfiles&gt;
    &lt;activeProfile&gt;chainguard&lt;/activeProfile&gt;
  &lt;/activeProfiles&gt;
&lt;/settings&gt;</code></pre>


**Gradle**

<p>Update the repositories block in <code>app/build.gradle</code> to point to Chainguard Libraries. If you are using the remediated repository, set it first.</p>
<blockquote>
<p><strong>Note</strong>: If your project manages repositories in <code>settings.gradle</code>, add the Chainguard repositories there instead.</p>
</blockquote>
<pre class="highlight" data-language="build.gradle"><code class="language-build.gradle" data-lang="build.gradle">repositories {
    maven {
        url = uri(&#34;https://libraries.cgr.dev/java-remediated/&#34;)
        credentials {
            username = providers.environmentVariable(&#34;CHAINGUARD_JAVA_IDENTITY_ID&#34;).orNull
            password = providers.environmentVariable(&#34;CHAINGUARD_JAVA_TOKEN&#34;).orNull
        }
    }
    maven {
        url = uri(&#34;https://libraries.cgr.dev/java/&#34;)
        credentials {
            username = providers.environmentVariable(&#34;CHAINGUARD_JAVA_IDENTITY_ID&#34;).orNull
            password = providers.environmentVariable(&#34;CHAINGUARD_JAVA_TOKEN&#34;).orNull
        }
    }
    mavenCentral()
}</code></pre><p>If a dependency&rsquo;s pom file is found in Chainguard but the JAR is not, Gradle fails rather than falling back to Central automatically. If this happens, check whether a newer version of the dependency is available in Chainguard&rsquo;s catalog and update the version in your <code>build.gradle</code>.</p>



**Bazel**

<p>Bazel uses <code>MODULE.bazel</code> to configure repositories via <code>rules_jvm_external</code>. The configuration described on this page uses <code>~/.netrc</code>, but note that <code>.netrc</code> only supports one set of credentials per hostname. Since all Chainguard Libraries are served from <code>libraries.cgr.dev</code>, configuring <code>.netrc</code> for Java will override credentials for any other ecosystem.</p>
<p>First, set up <code>~/.netrc</code> with your Chainguard credentials:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">printf &#39;machine libraries.cgr.dev\nlogin %s\npassword %s\n&#39; &#34;$CHAINGUARD_JAVA_IDENTITY_ID&#34; &#34;$CHAINGUARD_JAVA_TOKEN&#34; &gt; ~/.netrc
chmod 600 ~/.netrc</code></pre><blockquote>
<p><strong>Note</strong>: <code>~/.netrc</code> stores credentials in plaintext on disk. Be careful not to copy <code>.netrc</code> into a project directory where it could be accidentally committed to version control. Use short-lived tokens and rotate them regularly. In CI environments, prefer writing credentials to a temporary <code>.netrc</code> file that is cleaned up after the build, or use your CI platform&rsquo;s secrets management to inject credentials as environment variables instead. If you accidentally expose credentials, <a href="/chainguard/libraries/introduction/access/#pull-token-management">delete the exposed token</a>.</p>
</blockquote>
<p>Next, update the <code>MODULE.bazel</code> to point to Chainguard Libraries. If you are using the remediated repository, add <code>https://libraries.cgr.dev/java-remediated/</code> first:</p>
<pre class="highlight" data-language="module.bazel"><code class="language-module.bazel" data-lang="module.bazel">maven.install(
    artifacts = [
        # your artifacts here
    ],
    repositories = [
        &#34;https://libraries.cgr.dev/java-remediated/&#34;,
        &#34;https://libraries.cgr.dev/java/&#34;,
    ],
    use_credentials_from_home_netrc_file = True,
)</code></pre><p>The <code>use_credentials_from_home_netrc_file = True</code> attribute tells the dependency resolver to read credentials from <code>~/.netrc</code> when authenticating with repositories. Without this flag, the <code>~/.netrc</code> is ignored, and requests to Chainguard fail authentication silently.</p>






### Repository manager

If your organization uses a repository manager, configure it to use Chainguard Libraries as an upstream source first. Follow the [global configuration documentation](/chainguard/libraries/java/global-configuration/) for your repository manager.

Once configured, point your build tool at your repository manager URL. In this setup, the credentials your build tool uses are your repository manager credentials — not a Chainguard pull token.



**Maven**

<p>Create or update <code>~/.m2/settings.xml</code> to point Maven at your repository manager and override Central with invalid URLs. Refer to example settings files in <a href="https://github.com/chainguard-demo/chainguard-libraries-java/tree/main/tools">Chainguard&rsquo;s demo repository on GitHub</a> for different repository managers.</p>
<p>Use a configuration similar to the following. Make sure to update the credentials in the <code>server</code> section to use your repository manager account credentials, using environment variables when possible. This example uses environment variables for Artifactory credentials:</p>
<pre class="highlight" data-language="xml"><code class="language-xml" data-lang="xml">&lt;settings&gt;

  &lt;mirrors&gt;
    &lt;mirror&gt;
      &lt;!-- Set the identifier for the server credentials for repository manager access
      must match server name in &#34;servers&#34; --&gt;
      &lt;id&gt;example&lt;/id&gt;
      &lt;!-- Send all requests to the repository manager URL --&gt;
      &lt;mirrorOf&gt;*&lt;/mirrorOf&gt;
      &lt;!-- Ordered repository group with
        - java-remediated
        - java
        - Maven central
        - anything else needed, including internal repos
      --&gt;
      &lt;!--&lt;url&gt;https://repo.example.com:8443/repository/java-all/&lt;/url&gt;--&gt;
      &lt;url&gt;http://localhost:8081/repository/java-all/&lt;/url&gt;
    &lt;/mirror&gt;
  &lt;/mirrors&gt;

  &lt;!-- Activate repo manager and override central repo from Maven itself with invalid URLs --&gt;
  &lt;activeProfiles&gt;
    &lt;activeProfile&gt;repo-manager&lt;/activeProfile&gt;
  &lt;/activeProfiles&gt;
  &lt;profiles&gt;
    &lt;profile&gt;
      &lt;id&gt;repo-manager&lt;/id&gt;
      &lt;repositories&gt;
        &lt;repository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;http://central&lt;/url&gt;
          &lt;releases&gt;
            &lt;enabled&gt;true&lt;/enabled&gt;
          &lt;/releases&gt;
          &lt;snapshots&gt;
            &lt;enabled&gt;true&lt;/enabled&gt;
          &lt;/snapshots&gt;
        &lt;/repository&gt;
      &lt;/repositories&gt;
      &lt;pluginRepositories&gt;
        &lt;pluginRepository&gt;
          &lt;id&gt;central&lt;/id&gt;
          &lt;url&gt;http://central&lt;/url&gt;
          &lt;releases&gt;
            &lt;enabled&gt;true&lt;/enabled&gt;
          &lt;/releases&gt;
          &lt;snapshots&gt;
            &lt;enabled&gt;true&lt;/enabled&gt;
          &lt;/snapshots&gt;
        &lt;/pluginRepository&gt;
      &lt;/pluginRepositories&gt;
    &lt;/profile&gt;
  &lt;/profiles&gt;

  &lt;servers&gt;
    &lt;server&gt;
      &lt;id&gt;repo-manager&lt;/id&gt;
      &lt;username&gt;${env.ARTIFACTORY_USERNAME}&lt;/username&gt;
      &lt;password&gt;{env.ARTIFACTORY_PASSWORD}&lt;/password&gt;
    &lt;/server&gt;
  &lt;/servers&gt;
&lt;/settings&gt;</code></pre>


**Gradle**

<p>Update the <code>repositories</code> block in <code>app/build.gradle</code> to point to your repository manager, removing any direct references to <code>mavenCentral()</code> or other repositories if your repository manager already proxies them:</p>
<pre class="highlight" data-language="groovy"><code class="language-groovy" data-lang="groovy">repositories {
    maven {
        url = uri(&#34;https://repo.example.com/java-all/&#34;)
        credentials {
            username = providers.environmentVariable(&#34;REPO_MANAGER_USERNAME&#34;).orNull
            password = providers.environmentVariable(&#34;REPO_MANAGER_PASSWORD&#34;).orNull
        }
    }
}</code></pre>


**Bazel**

<p>First, configure your repo manager authentication in <code>~/.netrc</code>:</p>
<pre class="highlight" data-language="netrc"><code class="language-netrc" data-lang="netrc">machine repo.example.com
login YOUR_REPO_MANAGER_USERNAME
password YOUR_REPO_MANAGER_PASSWORD</code></pre><p>Then update MODULE.bazel to point to your repo manager:</p>
<pre class="highlight" data-language="module.bazel"><code class="language-module.bazel" data-lang="module.bazel">maven.install(
    artifacts = [
        # your artifacts here
    ],
    repositories = [
        &#34;https://repo.example.com/java-all/&#34;,
    ],
    use_credentials_from_home_netrc_file = True,
)</code></pre>





Replace `https://repo.example.com/java-all/` with your repo manager's virtual repository URL, and update the username and password.

## Step 4: Refresh dependencies

To force re-resolution from Chainguard, you can clear local caches or clear only relevant artifacts.



**Maven**

<p>Remove local cache:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">rm -rf ~/.m2/repository</code></pre><p>Remove specific artifact:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">rm -rf ~/.m2/repository/&lt;group&gt;/&lt;artifact&gt;</code></pre>


**Gradle**

<p>Remove local caches and stop any running daemons:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">rm -rf ~/.gradle/caches
./gradlew --stop</code></pre><blockquote>
<p><strong>Note</strong>: Run <code>./gradlew --stop</code> after clearing the Gradle cache to stop any running daemons. Skipping this step can cause build errors on the next run.</p>
</blockquote>



**Bazel**

<p>Remove the Bazel cache, including all downloaded artifacts and build outputs:</p>
<pre class="highlight" data-language="shell"><code class="language-shell" data-lang="shell">bazel clean --expunge</code></pre>





## Step 5: Build the project

Run a full build and capture the output.



**Maven**

<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">cd your-project
./mvnw install 2&gt;&amp;1 | tee /tmp/mvn-output.txt</code></pre><p>To check which repositories served completed downloads:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">grep &#34;Downloaded from&#34; /tmp/mvn-output.txt</code></pre><p>All downloads should come from <code>chainguard</code> or <code>chainguard-remediated</code>.</p>



**Gradle**

<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">cd your-project
./gradlew build --info 2&gt;&amp;1 | tee /tmp/gradle-output.txt</code></pre>


**Bazel**

<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">bazel build //... 2&gt;&amp;1 | tee /tmp/bazel-output.txt</code></pre><p>Bazel embeds the source repository URL in the cache path for each downloaded artifact.</p>






Look for lines beginning with `Downloaded from chainguard:` or `Downloaded from chainguard-remediated:` to confirm artifacts are being served by Chainguard.

If all artifacts download from Central, your credentials may be invalid or expired. Regenerate your pull token, re-export the pull token credentials as environment variables, then clear the cache and rebuild.

## Step 6: Verify artifacts

To check whether a specific artifact was built by Chainguard, use `chainctl libraries verify /full/path/to/artifact.jar`. Verify artifacts immediately after a clean build, before any repackaging.

When upstream fallback is enabled, [packages that aren't built by Chainguard] are subject to Chainguard's security controls.



**Maven**

<p>To list all downloaded JARs:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">find ~/.m2/repository -name &#34;*.jar&#34;</code></pre><p>Pick any JAR from the output to verify. For example:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">chainctl libraries verify \
  ~/.m2/repository/org/apache/commons/commons-lang3/3.13.0/commons-lang3-3.13.0.jar</code></pre><p>A checksum mismatch means the artifact came from Central rather than Chainguard. This can happen if the artifact was cached from a previous build. To resolve, delete the specific artifact and re-download it:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">rm ~/.m2/repository/org/apache/commons/commons-lang3/3.13.0/commons-lang3-3.13.0.jar
./mvnw dependency:get -Dartifact=org.apache.commons:commons-lang3:3.13.0</code></pre><p>Then run <code>chainctl libraries verify</code> again.</p>



**Gradle**

<p>Gradle stores JARs in a content-addressed cache. To list all downloaded JARs:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">find ~/.gradle/caches/ -name &#34;*.jar&#34;</code></pre><p>This command returns the full paths of your project dependencies. Choose one of the JARs, and verify it using the full path. For example:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">chainctl libraries verify ~/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/20.0/c2ea0b73679bc223a7ab119afd0ece31636173bc/guava-20.0.jar</code></pre><p>A checksum mismatch means the artifact came from Central rather than Chainguard. This can happen if the artifact was cached from a previous build. To resolve, delete the specific artifact and re-download it. For example:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">rm -rf ~/.gradle/caches/modules-2/files-2.1/commons-collections
./gradlew dependencies</code></pre><p>Then run <code>chainctl libraries verify</code> again.</p>



**Bazel**

<p>Bazel embeds the source repository URL in the cache path, making it easy to identify which JARs came from Chainguard. Use <code>find</code> to locate a JAR. For example:</p>
<p>Linux:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">find ~/.cache/bazel -path &#34;*cgr.dev*&#34; -name &#34;jackson-databind*.jar&#34; 2&gt;/dev/null</code></pre><p>MacOS:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">find ~/Library/Caches/bazel -path &#34;*cgr.dev*&#34; -name &#34;jackson-databind*.jar&#34; 2&gt;/dev/null</code></pre><p>Then verify using the full path. For example:</p>
<pre class="highlight" data-language="bash"><code class="language-bash" data-lang="bash">chainctl libraries verify ~/Library/Caches/bazel/_bazel_example/c22a55500...f4231148aeda823%40libraries.cgr.dev/java/com/fasterxml/jackson/core/jackson-databind/2.9.10/jackson-databind-2.9.10.jar</code></pre>





> **Note**: Running `chainctl libraries verify` requires the `libraries.java.pull` permission or the Owner role.

A successful result shows what percentage of your project's dependencies were built by Chainguard:

```bash
Artifact: /path/to/artifact.jar
Verification Coverage: 100.00%
```

## Packages not available in Chainguard Libraries

Chainguard Libraries covers a large and growing collection of Java packages, but not every package or version is available. If a package is missing, your install will fail with a 404 unless you have configured [upstream fallback](/chainguard/libraries/introduction/overview/#upstream-fallback-and-controls).

With upstream fallback enabled, packages not yet available from Chainguard are proxied from Maven Central, subject to Chainguard's security controls. Confirm your current policy with:

```shell
chainctl libraries entitlements list
```

For repository manager setups, Chainguard recommends using the configurable fallback rather than configuring a separate public registry fallback in your repository manager, to preserve Chainguard’s security controls.

Learn more about upstream fallback configurations in the [Libraries overview](/chainguard/libraries/introduction/overview/#upstream-fallback-and-controls).

When the upstream fallback is enabled, [build pinning](/chainguard/libraries/policies-and-security/build-pinning/) keeps a version you pulled from Maven Central stable after Chainguard publishes its own build. This prevents unexpected checksum mismatches across rebuilds.