Publishing to Maven Central for the first time is ...
# randomm
Marc Knaup
11/02/2017, 9:56 PMPublishing to Maven Central for the first time is a nightmare experience 😱
👍 1
k
karelpeeters
11/02/2017, 10:05 PMI just gave up.
👍 2
o
oshai
11/02/2017, 10:07 PMDid it via bintray, it was just 3/4 nightmare
m
Marc Knaup
11/02/2017, 10:16 PMYeah, bintray is quite simple in comparison!
They have a good gradle plugin and simple configuration.
Marc Knaup
11/02/2017, 10:24 PM@cedric looking forward to it 😵
Marc Knaup
11/02/2017, 10:30 PMIt’s live!
At least it’s quite straight-forward after you’ve got it into Sonatype and all checks have passed…
Marc Knaup
11/02/2017, 10:30 PMkotlin-dsl isn’t made for Sonatype publishing yet.
c
cedric
11/02/2017, 10:31 PMI upload to bintray and then sync to maven central
cedric
11/02/2017, 10:31 PMOf course, you still need the signed artifacts and all
m
Marc Knaup
11/02/2017, 10:35 PMYeah, signing was one thing which was annoying.
As was using the old maven publishing plugin which isn’t kotlin-dsl-friendly at all.
Didn’t know that you can sync from Bintray to Maven Central, nice!
Marc Knaup
11/02/2017, 10:36 PMI don’t get signing though. If everyone can sign with their own keys - how does that make things more secure?!
I didn’t have to register my key with my Sonatype account or something like that.
s
Sean Corfield
11/03/2017, 1:55 AM@Marc Knaup That was a question we wrestled with in the Clojure community (with our own clojars.org repository). The original idea was that artifacts would have two states: regular and "promoted", and the latter would only be allowed if they were signed. The theory was that Clojurians would exchange public keys to create a "web of trust" so that we could use "promoted" artifacts and check that they'd been signed by "known parties". In reality, not enough people felt the additional hassle of signing-and-sharing was worthwhile and the repository dropped the idea of promoted artifacts. A lot of people publish artifacts there without signing them now, because the hassle isn't worth it (and most Clojure JAR files are source anyway because it's compile-on-demand). TL;DR: signing really doesn't make things more secure if there's no verified "web of trust".
m
Marc Knaup
11/03/2017, 8:18 AMInteresting! Maybe with the rise of blockchain you'll get another shot at it :)
But yeah, I'm surprised that Maven Central requires it. Gives a false sense of safety I think.
2 Views