Can someone confirm to me that we cannot publish t...

# library-development

[Rafael Costa]

Can someone confirm to me that we cannot publish to maven central from a private GitHub repository? I have a use case at work where I'd like to do that, but all I read talks about public GitHub repositories 🤔

[andylamax]

if what you mean by "publishing from a private Github repository" is to publish from github actions from a private github repository, the answer is , "You can publish to maven central from that repository"

[Rafael Costa]

I wasn't necessarily thinking of github actions, the question was because the sonatype account and request for a new project, asks for a git url. Also even the usual ticket we create there is "_Community Support - Open Source Project Repository Hosting" -_ emphasis on "Open Source", and my library would not be "open source".

[Rafael Costa]

but this may be a stupid question 😅

[andylamax]

Ooooh, that I don't really know for sure. But it seems kind of inconvenient publishing a private library to a public maven repository.

[Rafael Costa]

tbh, we might just open source it.. I was kind of wondering if we could avoid it, but I don't see an issue with it.
At that point though, if we open source it, GitHub packages is also an option that allows everyone to use the library, right?
That is another question sorry, but just in case you know it 😄

Be basically just want to provide a small library to everyone who wants to use it. We have atm a private github repo (but we could make it public) and we are already using GH packages for other internal teams to use (so GH packages would be more convenient, if we could make them work for everyone and not just internal teams).

[mbonnin]

I'm 99% sure you can publish closed source to mavenCentral by shipping empty sources and javadoc jars. It's against the spirit of the repo but I don't think anyone is going to complain if you're doing it

[mbonnin]

You could also use other repos. I've used repsy.io in the past, it's working well

[Big Chungus]

Please don't publish ONLY to gh packages. They still don't support anonymous access and setting those repos and credentials up for each project is a pain.

[Rafael Costa]

thanks @mbonnin, I'll take a look at repsy. And thanks for letting me know that it should work to maven central as well

[Rafael Costa]

@Big Chungus you mean on the consuming side? Each project that needs to use it needs to use credentials (like github username and PAT)?
I hoped if repo is public all they needed was a maven declaration with the repo link

[Big Chungus]

I meant exactly that

[Rafael Costa]

@Big Chungus I see.. in our specific case, that wouldn't be a huge issue since the expectation is that only very specific teams will want to use this library.
The reason I'm considering it is because for maven central (afaik) there is a single authentication process, i.e, we only have one email/gpg key/password. But in the context of a team, we would need to share these to at least a couple of devs so that we can go there and close/publish. But then what happens if someone leaves the team? We need to change all keys, and passwords.
Or is there a way to have different credentials to access the same maven central account and we could just drop some individually? Do you know?

[mbonnin]

You can have different logins have access to the same groupId with MavenCentral. You'll just need to file a Jira ticket and let Joel Orlina do his magic 😄

[mbonnin]

Let me see if I can find an example

[Big Chungus]

Why would you need any credentials to pull from maven central?

[mbonnin]

Ah, I was thinking for pushing

[Rafael Costa]

I mean publishing

[mbonnin]

Yea, pulling is all public

[Big Chungus]

Publishing secrets should not be shared with people and instead stored on CI

[mbonnin]

For publishing, here is an example of adding members to a groupId

[Big Chungus]

That's the standard practice

[mbonnin]

But yea, agree with @Big Chungus there, you shouldn't need too much of that

[Rafael Costa]

Ofc Martynas, but what about credentials to login into maven where we do the closing and publishing. Those might not be part of the CI workflow

[mbonnin]

You can make it part of the CI workflow

[Big Chungus]

You can do that from ci too

[Rafael Costa]

And still, if I am setting up those keys and passwords, what if I leave the company? 😄

[Big Chungus]

Then you only have one set of credentials to hand over and change

[mbonnin]

Use a generic id ([e-mail]) instead of your own

[Rafael Costa]

hmm yeah.. I guess that's not to bad.

[Rafael Costa]

You're right Martynas

[Rafael Costa]

🙂

[Rafael Costa]

thanks a lot guys. I think I'll take the maven central route. If I see that actually we need to open source it, its just a matter of opening a IT ticket and have someone do it. I don't think we need to have this closed source.

[Rafael Costa]

@mbonnin btw.. you said with no javadocs and source jars. If I still include those by mistake, can I be in some kind of trouble? Or since the only affected party is my own company, so if I can tell them its ok, then it is ok? 😄

[mbonnin]

Oh yea, definitely ok if you don't mind

[mbonnin]

I don't think Sonatypes cares whatsoever you put in the -sources.jar. I think you could put a Hello.md in there and that'll work

[Big Chungus]

A lot of kmp libs have been pushing empty -javadoc.jar for years now with no issues