What I Learned from Publishing Libraries to Maven Central
summary
Ten years of publishing yields concrete rules: libraries exceed 100 million downloads per year, CI must sign artifacts with in-memory PGP keys so GPG happens on CI not a laptop, and Gradle pipelines use Gradle Nexus publish plugin or Gradle Maven Publish to create sources.jar, javadoc.jar, POM and .asc signatures, push to Sonatype staging, then close-and-release. Rotate tokens, verify DNS ownership for group IDs, and avoid mixing public repos; CircleCI was compromised (Jan 4 2023) and npm attacks (e.g. chalk ~300M/week) show supply-chain risk.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:28Maven Central explained
- 3:51CI system for libraries
- 4:57Library API strategy
- 6:45Versioning strategies
- 9:58GPG signing requirements
- 13:09Sonatype account setup
- 14:33Release file requirements
- 16:57Testing with Maven local
- 17:38Automating with Gradle plugins
- 19:26Verifying releases
- 21:35Staging repositories checks
- 24:01Immutable releases handling
- 25:26Supply chain attack examples
- 27:17Securing tokens and keys
- 28:01Dependency typo squatting
- 31:15Maven Gate attacks
- 34:13Validating GPG signatures
- 35:38Public repo security risks
- 38:09Ongoing supply chain attacks
- 39:12Conclusion and Q&A
related talks
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
29mDistributing to a public or private maven repository (en)
43mLibrary Developer Confidential
54mAvoiding a Shared Library Nightmare
30mBringing Continuous Delivery to Open Source
07m26 Feature Branches and other tales from the wild
38mKnow thy neighbours: dependency management done right.
08mAll About Dependencies