The RedHat Maven repo has binaries for many popular projects which are also in Maven Central. However, the versions don’t exactly match, and in many cases there are multiple binaries in the RH repo corresponding to a single artifact in MavenCentral.

For example, consider commons-io https://maven.repository.redhat.com/ga/commons-io/commons-io/. There are two versions that seem to correspond to the (Maven Central) version 2.11.0 — 2.11.0.redhat-00001 and 2.11.0.redhat-00002. Sometimes the sources (distributed in -sources.jar files in the respective folder for each version) between those don’t match, and it is unclear whether those sources / builds correspond to any release tag in some GitHub repo.

I try to better understand what this means, and what the best choice here is when declaring project dependencies.

Thanks