Prepare deploying to Maven Central through Sonatype

[leonardehrenfried]

Hi,

as discussed in #32 I'd like to help out with deploying this new version of Ficus to Maven Central. This used to be an awfully complicated process but several sbt plugins have made this a lot more streamlined.

Most small projects these days deploy to Maven Central via the Sonatype Repository. This then syncs with Maven Central.

There is an official guide on how to do that with sbt but we are going to use a couple of plugins so we don't have to use the super-confusing UI of the Sonatype Repository.

GPG keys

In order to be on Maven Central your artifacts have to be signed with PGP. If you already have a PGP key, great! If not create one with:

sbt pgp-cmd gen-key

Then deploy this key to a key server

pgp-cmd send-key ${keyname} hkp://pool.sks-keyservers.net

There are a few key servers around the internet and every few hours they syncronise with each other so eventually all keys will be on all servers. Sonatype and Maven/Ivy clients will validate the signature on the artifact with your public key to make sure it is exactly what you have published.

Sonatype account

You need to make an account at the Sonatype repo: https://issues.sonatype.org/secure/Signup!default.jspa

Now, this is the slightly tricky bit. You will have to decide under which group ID you want to publish. If it is net.ceedubs you will have to ask ceedubs to allow you to publish into his group id (he will have to open a ticket). If you want to publish under com.iheart you will have to open a ticket yourself at https://issues.sonatype.org/secure/CreateIssue.jspa?issuetype=21&pid=10134

They usually takes a few hours to respond and will ask you if you own the domain iheart.com. Just say yes.

After a while you the ticket will be closed and you'll be told that you now can publish into net.ceedubs or com.iheart (whichever it is).

Configure credentials

Create a file $HOME/.sbt/(sbt-version)/sonatype.sbt

Set Sonatype account information (user name and password) in the global sbt settings. To protect your password, never include this file within your project.

credentials += Credentials("Sonatype Nexus Repository Manager",
        "oss.sonatype.org",
        "(Sonatype user name)",
        "(Sonatype password)")

Publishing

Once you have the permission to upload you can simply run

sbt publishSigned

This will sign and upload your artifact to Sonatype's staging repository. If you want you can test this release first by adding the repo to your build.sbt.

If you're happy with the release and want to push to Maven Central run

sbt sonatypeRelease

This promotes the release to be ready for synching to Maven Central. It usually takes a few hours before it will show up in http://search.maven.org/ but the actual sync job runs every hour or so.

This process is not super-simple but I hope this step-by-step guide will help.

If you have more questions, I'm happy to help.

[kailuowang]

Thanks very much! The detailed guide is really nice. We use sbt-release here, can we add sonatype release as a second last step before the last publishchanges step?

[leonardehrenfried]

I just saw that the sonatype plugin has a section on how to combine it with sbt-release: https://github.com/xerial/sbt-sonatype#using-with-sbt-release-plugin

Should I implement a workflow like that?

[kailuowang]

Yes but please also make sure that it still publish to bintray as well.

[leonardehrenfried]

I would have to look at how the release plugin works but it is just an sbt
task so shouldn't be too hard to integrate.

I'm going to find out.

On 22 Oct 2016 13:53, "Kai(luo) Wang" notifications@github.com wrote:

Thanks very much! The detailed guide is really nice. We use sbt-release
here, can we add sonatype release as a second last step before the last
publishchanges step?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#34 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAJPMvI8jCI2ktlyLhzjtCxkWKzst3JGks5q2flEgaJpZM4Kd0rw
.

[kailuowang]

Now that jCenter having issues including newly added 2.12 artifacts, I am considering moving to sonatype and maven central. @joprice what do you think?

[leonardehrenfried]

Yeah sorry I haven't been able to get around to implementing this.

[leonardehrenfried]

I have now added the integration between sbt-sonatype and sbt-release. Would you be so kind as to try it out?

Also, do you still want to publish to Bintray as well? If you do, what is the sbt command that you use to do that?

[coveralls]

Changes Unknown when pulling f81775d on leonardehrenfried:master into ** on iheartradio:master**.

[kailuowang]

I am going to merge this and give it a try. I am not sure if we can/need to publish to both maven central and jcenter.