Does anyone know what are the credentials i need t...

# library-development

[ziv kesten]

Does anyone know what are the credentials i need to login to https://s01.oss.sonatype.org/#welcome?
I signed up to https://central.sonatype.com/ and generated a user name and password but they dont seem to grant me access, all the resources about publishing to maven central seem to indicate the need to log in to the nexus repository manager to get a OSS_STAGING_PROFILE_ID but i cant log in there.

[Robert Jaros]

New accounts don't use oss.sonatype.org anymore for publishing.

[Robert Jaros]

You should use Central Portal publishing: https://central.sonatype.org/register/central-portal/

[Robert Jaros]

You need to configure new publishing method in your project, e.g. https://github.com/GradleUp/nmcp

[ziv kesten]

Is this a privately maintained project? shouldn't i avoid relying on plugins like this in case they will stop being maintained in the future? what is the way to publish libraries to maven without 3rd party libraries?

[Robert Jaros]

there is none

[Robert Jaros]

https://central.sonatype.org/publish/publish-portal-gradle/

[Robert Jaros]

only community plugins are currently available for gradle

[Robert Jaros]

you could use maven, but it's not real alternative for kotlin

[ziv kesten]

I see, thank you very much for your help i will try to use nmcp 🙏

[Robert Jaros]

see also: https://kotlinlang.slack.com/archives/C3PQML5NU/p1707673013826779

[Ayfri]

Is there a time where the old users will be migrated ?

[mbonnin]

@ziv kesten I wrote that nmcp plugin and planning to continue maintaining it but I’m the only maintainer so far so there’s a high bus factor. If you’re looking for alternatives, you can check https://vanniktech.github.io/gradle-maven-publish-plugin/. The bus factor isn’t much higher but the plugin is more established and has more usage so probably a bit more robust 🤷 ?

[mbonnin]

@Ayfri I don’t think so and I wouldn’t like that to happen right now personnally. Central portal doesn’t support snapshots (which is probably ok) nor stats (more problematic as there’s no way that I know of to retrieve the stats)

[Ayfri]

I see

[Ayfri]

Thanks for the information !

[mbonnin]

Sure thing!

[louiscad]

There are other Kotlin devs like me in the GradleUp organization, so it theoretically increases the bus factor, plus I keep buses in check with the rear-view mirror on my bike 😄

[ziv kesten]

Thank you @mbonnin and @louiscad for the support of the community! I will try nmcp as soon as i get my namespace verified! it seems to work very well on my test project 🙏

[ziv kesten]

I successfully uploaded a library to maven using nmcp (🎉) but i am still unable to publish a signed version with the GPG, i created a GPG key and have tested and verified it by encrypting and decrypting files, i try to add it to my gradle like this

publishing {
    ...
}

signing {
    val keyId = findProperty("signing.keyId") as String
    val password = findProperty("signing.password") as String

    println("Key ID: $keyId") // prints correct key (last 8)
    println("Password: $password") // prints correct passphrase

    useInMemoryPgpKeys(keyId, password)
    sign(publishing.publications)
}

nmcp {
    publishAllPublications {
        username = findProperty("SONATYPE_USER_NAME") as String
        password = findProperty("SONATYPE_PASSWORD") as String
        publicationType = "USER_MANAGED"
    }
}

But ./gradlew publishAllPublicationsToCentralPortal fails with

Execution failed for task ':exceptionCatcher:signReleasePublication'.
> Could not read PGP secret key

Am i missing something basic here? (AGP 8.4)

[CLOVIS]

Use ./gradlew publishToMavenLocal and look into ~/.m2/repository to see what is generated exactly, so you can try changing the config easily

[CLOVIS]

(if you have all the environment variables mentioned on your local machine, the files should be exactly the same as what is sent to Central)

[Robert Jaros]

I'm also setting signing.secretKeyRingFile property

[CLOVIS]

hopefully that helps you experiment

[ziv kesten]

Are you creating the secring.gpg manually?

[ziv kesten]

@CLOVIS I get the same error when trying to run mavenLocal

[Robert Jaros]

I think so, don't remember, it's in my .gnupg folder for years :-)

[ziv kesten]

Seems like versions of gnupg later than 2.1 dont require this file, i use 2.4.5

[Robert Jaros]

I was probably following this guide: https://docs.gradle.org/current/userguide/signing_plugin.html#sec:signatory_credentials

[mbonnin]

Fwiw, I like using in-memory keys

[mbonnin]

https://vanniktech.github.io/gradle-maven-publish-plugin/central/#in-memory-gpg-key

[mbonnin]

Saves the hassle of maintaining a .gpg folder, having the cli in the path etc ...

[ziv kesten]

Thank you everyone for the help, i used asciiArmoredKey from a file like this:

signing {
    val keyIdPath = findProperty("signing.keyIdPath") as String
    val password = findProperty("signing.password") as String

    val asciiArmoredKey: String = File(keyIdPath).readText()

    useInMemoryPgpKeys(asciiArmoredKey, password)
    sign(publishing.publications)
}

And together with the nmcp plugin, everything works great! thank you! 🦜