Migrating old artifacts from JCenter to MavenCentral

I hope a more convenient way is created. I've deployed some projects via Sonatype in the past. And while they are friendly and responsive, it's a complicated process that involves manual approvals by them (for your first release), setting up gpg keys, etc. It takes days for this to happen. It's a big reason jCenter became so popular: it removed a lot of the friction for publishing a simple jar.

One thing with jcenter is that you can actually propagate your jars to maven central if they meet minimum requirements (like having javadoc and sources and the right meta data). Many popular jars are actually propagated to maven central that way. I've done that with one of my projects and it already is in maven central. Once there, it will stay there.

The issue here is not Sonatype but the fact that the Apache Foundation is understandably very selective about which companies they allow jars to propagate to maven central. Unlike python, ruby, node.js, etc. there is no public repository where you can sign up and publish your jars. Instead you publish to one of a select few of repositories they replicate from, which effectively means Sonatype or JCenter.

For a long time, Sonatype's repository for OSS jars was the only way to get into maven central. Basically you publish your jars on their repository and then some time after that, maven central picks up the changes. I expect the Sonatype people will be very busy in the next months dealing with the fallout of JCenter disappearing. So, expect some delays. That may be a good moment for them to reconsider some of their processes around this.

A more modern/user friendly way would be helpful. Maybe Amazon, Microsoft/Github, or Google could step up and provide something. Or all of them. Or maybe they can even work together to make that happen. After all, MS bought npm as well.

+100

I've been doing Android development (incl. publishing libraries) since 2010 and the Android community is way behind every other community in the tools available for library publishers. iOS has Cocoapods and SPM, Web has NPM (and Yarn), Flutter has pub, etc.

JCenter/Bintray made it possible for an independent dev to figure out how to share their utilities with others but even then it was too hard. Everyone has their own hacked together Gradle publishing script to assemble the right AARs, JARs, POMs, etc.

But the Android community has a really bad habit of accepting things that are too hard because simplicity is for Bad Programmers. So we will accept this, and 10 years from now we'll continue to be in a place where Google and Square publish 90% of the good Android libraries and the community is still hugely underdeveloped.

I wish Java would move to more distributed artifact storage. Just specify URL and let your build tool download library there. Why does it have to be some kind of central storage? It's not like they perform some curating or static analysis or something like that.

I hear a lot of complains about the Sonatype process being not trivial. Here is a background article about why:

https://blog.sonatype.com/why-namespacing-matters-in-public-...

And with signed artifacts that wouldn't have happened.

https://docs.gradle.org/current/userguide/dependency_verific...

> Note that a variation of a compromised library is often name squatting, when a hacker would use GAV coordinates which look legit but are actually different by one character, or repository shadowing, when a dependency with the official GAV coordinates is published in a malicious repository which comes first in your build.

Best part is that the documentation literally describes the attack used here.

Another example where npm and co are reinventing the same issues that Java has already solved long ago.