Publishing to Maven Central

[cstamas]

It would be good to have all JARs (java-ipfs-http-client and all deps) published to Maven Central. There were already several attempts recorded:

• Publish packages in Maven Central multiformats/java-multibase#32
• Publish to maven central multiformats/java-multihash#24
• (maybe more that I missed?)

For this to happen:

• we need to bring all projects "in shape" for publishing (they must pass requirements)
• we need to register namespace with Sonatype, I guess io.ipfs (at least package name suggest this)
• we need to assign publishers (who are set up for publishing, with things like GPG keys) to the registered namespace

Are we interested in doing this?

Of course, we can continue to use jitpack.io as secondary publishing service, there is not problem with that.

[cstamas]

@ianopolous @vorburger @manandbytes @odisseus or anyone else? Opinions?

[manandbytes]

Of course, we can continue to use jitpack.io as secondary publishing service, there is not problem with that.

I do vaguelly remember having some cons few years back, https://committing-crimes.com/articles/2024-09-09-jitpack/ summarizes them pretty well. As of now, jitpack is the only publishing service for the project and it is better to move to Central.

[cstamas]

As I said, we have several options:

• continue using jitpack.io as before
• also add Central publishing
• also publish to IPFS with something like https://github.com/maveniverse/ipfs ? Hopefully someone could sponsor some pinned storage provider, as my repo (made for testing) is backed by two nodes running 24/7 (from DK and HU) and is dead slow: https://ipfs.maveniverse.eu/

Personally (but also with my ASF Maven PMC hat on), I fully share the sentiment in the refd article.

[cstamas]

Or in other words: I have no insight into what and how jitpack.io does, but I get feeling they don't care either (nobody cared about this Maven 4 issue, was closed due "lack of activity": jitpack/jitpack.io#7186).

Hence, tossing your sources onto a "black box" and hoping you get back what you expect to get... instead to build release once, publish it (like to central) once -- as Maven releases are immutable -- and lock them down with SHA512 makes much more sense to me, personally.

[cstamas]

One thing for sure: if we want to use multiple services, we want to make sure our build is reproducible, and hopefully all service serve JARs with same checksums/hashes (ie SHA512).

[ianopolous]

Yep, I'm not a fan of jitpack, and never used it myself, but I also don't want to manage another key pair myself.

[cstamas]

I already manage 7 Namespaces on Maven Central, so am happy to add 8th to that set. Of course, you or some other "owner" should register that Namespace and then add me (Sonatype lingo: "Namespace" is a prefix like io.ipfs and it allows you to publish under that namespace specific artifacts, like io.ipfs.java etc.)

My publishing key is listed on ASF Maven project https://downloads.apache.org/maven/KEYS as https://keyserver.ubuntu.com/pks/lookup?search=88BE34F94BDB2B5357044E2E3A387D43964143E3&fingerprint=on&op=index

[cstamas]

Ideally, we could automate release on GH like Guillaume did on jline3:
https://github.com/jline/jline3/blob/master/.github/workflows/release.yml

He uses https://github.com/maveniverse/njord to publish to Central (so is Quarkus project for example) and does everything on GH. Downside: recently there are quite some GH CI outages, in that case you are forced to wait.

[vorburger]

@ianopolous @vorburger @manandbytes @odisseus or anyone else? Opinions?

I personally am happy to continue using JitPack (here), for now; the time I currently have available for that project doesn't justify me investing my time into helping with regular manual publishing of artifacts of this and related project to Maven central so that I can depend on them myself - I regret that I cannot make more time available for that purpose!

I already manage 7 Namespaces on Maven Central, so am happy to add 8th to that set. Of course, you or some other "owner" should register that Namespace and then add me (Sonatype lingo: "Namespace" is a prefix like io.ipfs and it allows you to publish under that namespace specific artifacts, like io.ipfs.java etc.)

I manage a few myself (ch.vorburger), so I'm familiar with Sonatype and already set-up with GPG anyway, so in case you would like to add me "as a backup, just in case you get run over by a bus", then I don't "mind" that - but don't expect me to actively publish anything from here.

also publish to IPFS with something like https://github.com/maveniverse/ipfs ? Hopefully someone could sponsor some pinned storage provider, as my repo (made for testing) is backed by two nodes running 24/7 (from DK and HU) and is dead slow: https://ipfs.maveniverse.eu/

Now THIS sounds FUN... 😸 I'll sponsor! 🤑 But I'm just not entirely sure how we would do this in practice?

Do you want to create a separate new issue about that? (As it's technically entirely unrelated to Publishing to Maven Central.)

[cstamas]

Created #264