3 ms·
It's not just as available to add to; you can only add to Central through one of three approved hosts unless your project has a special exception. And those hos
by thehardsphere 9y ago
It's not just as available to add to; you can only add to Central through one of three approved hosts unless your project has a special exception. And those hosts all involve an actual review of your artifact, its signature, and your POM.
I've never done it, but it at least sounds like there's a process where you need to convince 3 or more people that adding your package is a good idea and will not hurt security. That's very different from PyPI or npm.
- chii 9y agoyou don't need to convince anyone other than the central hoster - provide an issue in the tracker with the information required (see the myriad of existing projects https://issues.sonatype.org/projects/OSSRH/issues/OSSRH-34621?filter=doneissues&orderby=created+DESC%2C+updated+DESC https://issues.sonatype.org/projects/OSSRH/issues/OSSRH-3462...). It's not a free-for-all like npm, but may be npm can learn a thing or two.
- watwut 9y agoThere is only one person and you are not convincing the person much about security nor have to go through any kind of difficult vetting. Just formal stuff about packege naming, properly filled pom.xml and such. However, you have to sign everything with pgp including updates and that is verified. You also have to own the domain with same path as your packages - meaning name space is larger and name clashes less likely. They actually check this and won't release unless you host project. Which explains why java open source tend to use packages like com.github.my_account.my_project