Recently, we need to deploy some jar to maven for open source reason, so we through some trial and errors finally make it. This blog is for future reader for review.
Registration
Introduction to Sonatype OSSRH
Sonatype OSSRH uses Nexus to provide deployment service for open source project, and this repo is called maven central, in which OSSRH all us to submit and download binary jar.
Registration
Notice:
- Only when this issue’s state change to
RESOLVED
, we can start to deploy jar; - If we deploy on behalf of yourself, we should be careful about
groupId
: e.g. our project is put on github called syncer, sogroupId
can becom.github.zzt93
;
Update POM
After the registration and issue resolved, we need to add more info in pom to do the deployment: name
, description
, url
, groupId
, artifactId
, version
, license
, developers
, scm
<name>${project.groupId}:${project.artifactId}</name>
<url>https://github.com/0604hx/nerve-tools</url>
<description></description>
<licenses>
<license>
<name>The Apache License, Version 2.0</name>
<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
</license>
</licenses>
<developers>
<developer>
<name>0604hx</name>
<email>zxingming@foxmail.com</email>
<roles>
<role>developer</role>
</roles>
<timezone>+8</timezone>
</developer>
</developers>
<scm>
<connection>scm:git:https://github.com/0604hx/nerve-`tools.git</connection>
<developerConnection>scm:git:https://github.com/0604hx/nerve-tools.git</developerConnection>
<url>https://github.com/0604hx/nerve-tools</url>
<tag>v${project.version}</tag>
</scm>
Then, add distributionManagement
:
<distributionManagement>
<snapshotRepository>
<id>ossrh</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
</snapshotRepository>
<repository>
<id>ossrh</id>
<name>Maven Central Staging Repository</name>
<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
</repository>
</distributionManagement>
Then related plugins: staging
for release, add javadoc
, add source
, use gpg
to sign
<plugins>
<plugin>
<groupId>org.sonatype.plugins</groupId>
<artifactId>nexus-staging-maven-plugin</artifactId>
<version>1.6.3</version>
<extensions>true</extensions>
<configuration>
<serverId>ossrh</serverId>
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
<autoReleaseAfterClose>false</autoReleaseAfterClose>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>2.10.3</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar-no-fork</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>1.6</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
Generate & Send Key
Since other people need our public key to verify our jars, we need to distribute our public key to a key server:
gpg --gen-key
gpg --keyserver http://keyserver.ubuntu.com:11371/ --send-keys KEY_ID
If you met the following error when signing jar file:
signing failed: Inappropriate ioctl for device
Here gives the solution:
export GPG_TTY=$(tty)
Update setting.xml
Add account & password in OSSRH, add profile
of gpg
for sign
<server>
<id>ossrh</id>
<username>your-jira-id</username>
<password>your-jira-pwd</password>
</server>
...
<profile>
<id>ossrh</id>
<activation>
<activeByDefault>true</activeByDefault>
</activation>
<properties>
<gpg.executable>gpg2</gpg.executable>
<gpg.passphrase>the_pass_phrase</gpg.passphrase>
</properties>
</profile>
Deploy
mvn deploy -Dmaven.test.skip=true -e
No secret key
If maven compile that:
gpg: no default secret key: No secret key
it means that the phase of [Generate Key] failed, no secret key is not found.
No public key:Key with id
If the following error shows:
No public key:Key with id
It means that the command gpg --send-keys xx
failed, try other key servers in the list of trying one instead.
Release
When last step succeeds, we have already upload our release (non-snapshot)
artifacts to the remote repo, but we actually only upload it to a staging repo:
<snapshotRepository>
<id>ossrh</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
</snapshotRepository>
<repository>
<id>ossrh</id>
<name>Maven Central Staging Repository</name>
<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
</repository>
In order to release it, we need:
- Sign in http://oss.sonatype.com
- Click
Staging Repositories
in the left panel - Choose the right
Repository
& Click theRelease
- Go to the issue we created before and tell the admin that we have released, then wait.
After you successfully release, your component will be published to Central, typically within 10 minutes, though updates to search.maven.org can take up to two hours.
- Search our artifact in central !
On the other hands, our snapshot
artifact is no need to have above release operation, we can access it if we have snapshot repo
in our pom:
<repository>
<id>ossrh</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
</repository>
Ref
- Working with pgp signature
- A Chinese blog about deploy to maven central
Written with StackEdit.
评论
发表评论