Libraries in Sonatype

When publishing a library for external consumption, we release via sbt to Sonatype, an online repository.

Publishing to sonatype via sbt requires the sonatype sbt plugin to be installed. Because we’re talking about security and signing, these cannot be put into the project repository - these have to live on the developer machine, outside the project being published.

That requires a few items in a directory which is going to make sense according to your build.sbt for the relevant project. It will have a line like:

credentials += Credentials(file("/dev/.ivy2/.ivy2/ivy-credentials"))

So you need to update the referenced file to

realm=Sonatype Nexus Repository Manager
host=oss.sonatype.org
user=StackableRegiments
password={the password}

Of course, if it’s been pushed out of the standard location with an external reference, the file would have to contain:

realm=Sonatype Nexus Repository Manager
host=oss.sonatype.org
user={account username}
password={account password}

and would be pointed with:

credentials += Credentials(file("{location of file}"))

In addition to that, you can’t just use sbt publish, you have to use sbt publish-signed, which means that you’ve got to generate GPG keys as a one-time task on the publishing device:

sbt
set pgpReadOnly := false
pgp-cmd gen-key

Enter the name associated with the key, which becomes {the identity of the key}

pgp-cmd send-key {the identity of the key} hkp://keyserver.ubuntu.com

That last command will ask you for your name, your email address and require you to set a password on your private key.

Now that you’ve generated a key (which should now appear in ~/.sbt/gpg/), you should be able to:

sbt publish-signed

and once you’re happy with it,

sbt sonatypeRelease

which will send it to maven central (in probably 10 minutes)