A modern programming language that makes developers happier.

kotlinlang

We should probably discuss about this: <https://github.com/ChuckerTeam/chucker/issues/56>

Historically Chucker was distributed via JCenter. We moved to JitPack as it was easier to do a release and there is no need to handle a GPG Key.

Seems like a lot of users are asking to have distribution via MavenCentral. Thoughts?

GPG key setup (and other configuration) can be done only once
I’m using shipkit in my recent projects: <https://github.com/mockito/shipkit>

Yes, it is time to seriously consider distribution via Maven Central.

Nice toolkit. Thanks for sharing, Karol.

&gt;  GPG key setup (and other configuration) can be done only once
My point was more that there is a private key to share between developers and so. I know that MavenCentral is not really strict on GPG signing, so that shouldn’t be a major deal. On the other hand, Gradle introduced signature validation since 6.2 so we should probably be sure we know where the key/passphrase is and who can access it.

As for the tool you suggested <@U1QN3NEDQ> that looks really interesting :face_with_monocle: This could potentially replace JitPack (other than the branch publishing I think?)

In case of shipkit (or perhaps any other solution basing on synchronization from jcenter to maven central) a GPG key may exist on bintray. Eg. uploaded once by admin/owner, no need to share it.

Hi! I'm ~Rafa~ Sloy, the one who recently commented on this issue. Let me know if there's anything I can help with :slightly_smiling_face:

&gt;  Eg. uploaded once by admin/owner, no need to share it.
That’s actually the point that raises more concern for me. Like I create a key and I upload it on Bintray. What happens if, in a near future, we want to publish directly to Sonatype and we need to sign locally the artifacts?

AFAIK maven central only validates if gpg public key is uploaded to key server

My point is about having to manually sign an artifact. Maven Central requires that uploaded artifacts are signed. If you don’t have access to the GPG key you can’t sign them.

correct, but you can generate a new key if you lose previous one

Exactly. That would break GPG Key validation on the Gradle side (is basically the whole point behind GPG)

AFAIK if key is uploaded to keyserver before publishing to maven central it should pass the validation

I’m talking about validation on Gradle side: <https://docs.gradle.org/current/userguide/dependency_verification.html>

And this is happening :+1: <https://kotlinlang.slack.com/archives/CRWD6370R/p1590140747042400>

Woa! That's great news! :smile: :raised_hands: