Sonatype occupies an unusual position. The company operates Maven Central, which means it sees an enormous proportion of the Java ecosystem's dependency traffic, and it publishes annual research on open source consumption patterns and malicious package activity that is cited widely because nobody else has the vantage point. When Sonatype says something about how organisations actually consume open source, it is speaking from data rather than from a survey. That makes the decision to gate its training behind a customer login genuinely frustrating, because the knowledge is more broadly useful than the product is.
What sits behind the login is decent. Sonatype Learn was rebuilt on a proper learning management system in 2026 with refreshed courses and new video content, and offers around nine self-paced courses covering Nexus Repository, Lifecycle policy configuration, dependency management and supply chain risk, alongside interactive tutorials and short-form videos. The subject matter is more important than its profile suggests. Repository management specifically is one of those skills nobody is taught and everybody eventually needs: how artefact repositories work, why proxying upstream registries matters, how to structure hosted and group repositories, what a repository does about caching, retention and promotion between environments.
Most engineers meet this by inheriting a Nexus or Artifactory instance that somebody configured in 2019 and that now holds four hundred gigabytes of snapshot builds. The supply chain security content sits on top of that and covers policy enforcement, component evaluation and the workflow of catching a vulnerable or malicious dependency before it reaches production. This is real work and the threat is not hypothetical. Typosquatted packages, compromised maintainer accounts and dependency confusion attacks have all produced serious incidents in the last few years, and the defensive practices are learnable.
The gating is the problem and it is worth being direct about why. Software supply chain security is a subject where broad public competence is in everybody's interest, including Sonatype's, because an ecosystem where more teams understand dependency risk is an ecosystem where the company's research is more relevant and its product easier to sell. Restricting the training to existing customers means the person who most needs it, an engineer at a company with no supply chain practice at all, trying to build the argument for one, cannot access the material that would help them make it. This is the same pattern I have criticised at ZoomInfo University, Salesloft Academy and Sisense Academy, and it stings more here because of the subject.
The comparison that makes the point is Chainguard. Chainguard Academy is a free, ungated reference library covering container security, image hardening, SBOMs and supply chain concepts, open to anyone with a browser. Semgrep Academy is similarly free. Both are competitors in overlapping parts of this market and both concluded that teaching the discipline publicly serves them better than restricting it.
Sonatype concluded otherwise, and a learner comparing the two options has an easy decision. There is no public certification. The instructor-led workshop catalogue is substantial, covering Nexus Repository, Lifecycle Fundamentals, Lifecycle Policy, Lifecycle Champion, Lifecycle Developer and an Advanced Legal Pack, in half-day and full-day formats delivered publicly, on site or online, with pricing available only by contacting Sonatype. Unpublished pricing is a pattern I have flagged repeatedly and it means the same thing every time: the price varies by who is asking, and you cannot evaluate value without entering a sales conversation.
The Legal Pack workshop is worth a specific note because open source licence compliance is a genuinely under-taught area. Engineers routinely pull in dependencies without any idea whether the licence is compatible with how their company ships software, and the consequences surface at acquisition due diligence when it is far too late to change anything. Training on this exists in very few places. It is behind this login.
Three point two. Substantial, well-rebuilt training on an important and under-taught subject, from a company with better data on it than anyone, made irrelevant to most of the people who need it by a customer-only gate that its own competitors have chosen not to impose.