I find that the restrictions of Maven Central are ...

# klibs-io

[אליהו הדס]

I find that the restrictions of Maven Central are very discouraging for those who would like to create libraries and do not necessarily have the courage to ask for an exemption; I think it might be correct to consider a kotlinMultiplatformCentral() because the KMP ecosystem is growing, we see new libs every day, but I am afraid it might be discouraging. ideally, something that works as simply as jitpack

[mbonnin]

We should have metadata-only repositories. Metadata provide the security at a fraction of the cost of hosting all the artifacts.

[Bernd Prünster]

I like the idea, but metadata-only repos won't keep artefacts from being taken down. Say I self-host my binaries, and publish metadata to maven central. Three years from now, I stop caring and shutdown my server.

[mbonnin]

One more incentive to proxy the artifacts, decentralize things and reduce the load on the origin server.

[mbonnin]

Also, Sonatype can also pull the plug any time.

[Bernd Prünster]

sure they could, but just like honest Achmed put it, they are, realistically too big to fail.
Or less cynical: sure they could, but it would be noticed immediately. If two dozens of ten thousand distributed artifactories would go down, and you depend on one of them you can whine all you want, but your builds would remain broken. And I am not even talking about neglect or malicious intent. De you really believe there are multiple alternative that would provide the same resilience and level of opsec?

But I think we may be in agreement: decentralise, but govern + fallbacks?!

[mbonnin]

Maven Central is too big to fail but the most likely scenario is they start decommissioning “older artifacts, with low access patterns”. Sure it will break the trust, etc… but they are already starting to send 429 and put quota on uploads. Nothing is forever in this world.

[mbonnin]

This is the tragedy of the commons and incentiving the consumers that their dependencies have a cost goes the good direction IMO.

[Dmitrii Krasnov]

Thanks for raising this and for the thoughtful discussion. We in klibs.io are considering different approaches around this topic, but at this point we don't have any concrete plans and aren't ready to commit to implementing a particular solution.
Since this topic concerns the broader Kotlin Multiplatform ecosystem rather thatn klibs.io specifically, I'd suggest continuing the discussion in the #C3PQML5NU channel, where it can reach the wider community and the relevant stakeholders.
fyi @Emil Flach