4 ms·

This is very big and will affect a lot of java projects, JCenter is one of the most important central repositories currently available, specially because of bin

This is very big and will affect a lot of java projects, JCenter is one of the most important central repositories currently available, specially because of bintray since publishing to actual maven central was quite a lot harder than bintray.

luseg 6y ago
This actually makes the world a better place. Every serious Java project is capable of meeting Maven Central‘s few requirements and publish artifacts there. Bintray is just a place to put stuff on the internet. Which serious project would use artifacts from such a place?
- MrDresden 6y ago
  A wast number of the applications in the Android ecosystem use JCenter.
  - tadfisher 6y ago
    Most of them don't need to. The default project template inserts jCenter() in the buildscript, but most artifacts are proxied from Central.
    - MrDresden 6y ago
      No I mean that a vast number of the libraries in the Android ecosystem are actually hosted on the free jcenter repository. Removing jcenter as a source in the buildscript is a trivial step but doesn't remedy the issue as the dependencies are not all mirrored elsewhere. Complexities of setting up a Maven central account is often listed as the main cause for maintainers simply going for JCenter instead.
- tn1 6y ago
  > Which serious project would use artifacts from such a place? Plenty of them, since it's just adding a few lines to either pom.xml or the Gradle script. Sure, maybe there's rules against it in your org, but if it works then a code reviewer might say whatever, there's bigger problems
- WatchDog 6y ago
  Publishing to maven central isn't particularly difficult, but it is a high friction process. You have to file an issue on a JIRA board. Provide proof of owning a namespace(dns txt record, or github). Wait for a human to review and approve the ticket. Create a PGP key. Publish the PGP key to public key servers. Submit your builds via the webapp. Wait for the verification process to complete. Have it fail a bunch of times randomly, because despite uploading your PGP key to as many of the keyservers as you could, there seems to be a huge key replication delay between keyserver instances, and the verification process can't find the key published. Once verified, actually publish the build. Most of the pain is one off, once you have gone though it, publishing new builds can be automated. The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.
  - lmm 6y ago
    > The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts. I check them on every build, with the pgpverify maven plugin: https://github.com/m50d/tierney/blob/master/free/keys.properties https://github.com/m50d/tierney/blob/master/free/keys.proper... . Presumably I'm not the only one since that plugin exists.
    - WatchDog 6y ago
      Well, you have ended my streak I guess.
  - twic 6y ago
    Seconded - the process is fine if you're an Apache project or whatever, but for an individual developer with a handful of small libraries to share, it's not worth it.
    - luseg 6y ago

luseg 6y ago

This actually makes the world a better place. Every serious Java project is capable of meeting Maven Central‘s few requirements and publish artifacts there. Bintray is just a place to put stuff on the internet. Which serious project would use artifacts from such a place?

MrDresden 6y ago
A wast number of the applications in the Android ecosystem use JCenter.
- tadfisher 6y ago
  Most of them don't need to. The default project template inserts jCenter() in the buildscript, but most artifacts are proxied from Central.
  - MrDresden 6y ago
    No I mean that a vast number of the libraries in the Android ecosystem are actually hosted on the free jcenter repository. Removing jcenter as a source in the buildscript is a trivial step but doesn't remedy the issue as the dependencies are not all mirrored elsewhere. Complexities of setting up a Maven central account is often listed as the main cause for maintainers simply going for JCenter instead.
tn1 6y ago
> Which serious project would use artifacts from such a place? Plenty of them, since it's just adding a few lines to either pom.xml or the Gradle script. Sure, maybe there's rules against it in your org, but if it works then a code reviewer might say whatever, there's bigger problems
WatchDog 6y ago
Publishing to maven central isn't particularly difficult, but it is a high friction process. You have to file an issue on a JIRA board. Provide proof of owning a namespace(dns txt record, or github). Wait for a human to review and approve the ticket. Create a PGP key. Publish the PGP key to public key servers. Submit your builds via the webapp. Wait for the verification process to complete. Have it fail a bunch of times randomly, because despite uploading your PGP key to as many of the keyservers as you could, there seems to be a huge key replication delay between keyserver instances, and the verification process can't find the key published. Once verified, actually publish the build. Most of the pain is one off, once you have gone though it, publishing new builds can be automated. The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.
- lmm 6y ago
  > The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts. I check them on every build, with the pgpverify maven plugin: https://github.com/m50d/tierney/blob/master/free/keys.properties https://github.com/m50d/tierney/blob/master/free/keys.proper... . Presumably I'm not the only one since that plugin exists.
  - WatchDog 6y ago
    Well, you have ended my streak I guess.
- twic 6y ago
  Seconded - the process is fine if you're an Apache project or whatever, but for an individual developer with a handful of small libraries to share, it's not worth it.
  - luseg 6y ago