https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/RELENG-28 releng <p>I've been told that in order to release artifacts to Maven Central we need to follow the instructions for OSSRH.</p> <p><a href="http://central.sonatype.org/pages/ossrh-guide.html" class="external-link" target="_blank" rel="nofollow noopener">http://central.sonatype.org/pages/ossrh-guide.html</a></p> <p>Operating System: All<br/> Platform: All</p> RELENG-28

Release artifacts to Maven Central

Improvement Resolved Done Thanh Ha (zxiiro) Thanh Ha (zxiiro) Wed, 30 Mar 2016 19:32:11 +0000 Tue, 13 Nov 2018 02:13:59 +0000 Mon, 29 Oct 2018 18:43:56 +0000 unspecified Autorelease 0 7 <p>OSSRH has some minimal requirements that need to be met in order to release.</p> <p><a href="http://central.sonatype.org/pages/requirements.html" class="external-link" target="_blank" rel="nofollow noopener">http://central.sonatype.org/pages/requirements.html</a></p> <p>One issue I see from the requirements is our SCM section URLs point to project wiki pages. As the OSSRH documentation states this URL is supposed to be the URL to your git repository.</p> <p>According to Sonatype the recommended way is OSSRH. They do allow some sites to publish to Maven Central but these sites must be trusted and meet their requirements before they'll allow syncing.</p> <p>I think we should just use OSSRH as that's the easier path forward. With that said it looks like we have some more work to do before we can push to OSSRH in regards to our pom metadata.</p> <p>So the current problem is fixing all the pom files so that SCM URLs point to our git repositories. That should be relatively easy to script.</p> <p>I suggest we make this depends on <a href="https://jira.opendaylight.org/browse/ODLPARENT-22" title="Automatically include README and CONTRIBUTING file in jar" class="issue-link" data-issue-key="ODLPARENT-22"><del>ODLPARENT-22</del></a>.</p> <p>How about <a href="https://git.opendaylight.org/gerrit/#/c/42052/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/42052/</a> ?</p> <p>I've applied for an account here:</p> <p><a href="https://issues.sonatype.org/browse/OSSRH-42040" class="external-link" target="_blank" rel="nofollow noopener">https://issues.sonatype.org/browse/OSSRH-42040</a></p> <p>This should cover the staging job side of things: <a href="https://gerrit.linuxfoundation.org/infra/12318" class="external-link" target="_blank" rel="nofollow noopener">https://gerrit.linuxfoundation.org/infra/12318</a></p> <p>Looks like Maven Central requires PGP signatures in order to release to it. We need to get Sigul automation in place to sign the artifacts during the staging job.</p> <p>Yeah. I do this for what I have up on <a href="http://repo1.maven.org/maven2/ch/vorburger/" class="external-link" target="_blank" rel="nofollow noopener">http://repo1.maven.org/maven2/ch/vorburger/</a>. What is Sigul?</p> <p><a href="https://pagure.io/sigul" class="external-link" target="_blank" rel="nofollow noopener">https://pagure.io/sigul</a></p> <p>It's an infrastructure component that we're rolling out to projects that LF hosts. It's a secure way of allowing automated PGP signing of artifacts (detached signature for most or embedded in the case of RPM packages)</p> <p>We've had the sigul server itself available for some time but it's taken us a while to build most of the framework needed to actually use it in jobs. This framework is finally available and we're rolling out the final components into our CI infrastructure over the next few weeks.</p> <p>Once it's in place we can update jobs to take advantage of it.</p> <p>OSSRH requires that the sigul public key be available on a public key server. We've uploaded it.</p> <p>Discussed with <a href="https://jira.opendaylight.org/secure/ViewProfile.jspa?name=agrimberg" class="user-hover" rel="agrimberg">agrimberg</a> regarding also adding the Checksum, Javadoc, and Sources checks to our own Nexus ruleset too (and eventually signature validation) considering we need those anyway.</p> <p>Patch proposed <a href="https://gerrit.linuxfoundation.org/infra/12318" class="external-link" target="_blank" rel="nofollow noopener">https://gerrit.linuxfoundation.org/infra/12318</a></p> <p>This should be available in global-jjb v0.27 assuming it gets merged.</p> Blocks ODLPARENT-22 Development External issue ID 5630 External issue URL Rank 0|i01m3r: