Publish BIRT on Maven Central

Summary

We want to publish the BIRT runtime on Maven Central.

Steps to reproduce

It is necessary to have an OSSRH account tied to the root group ID (org.eclipse) in order to publish to Maven Central. The wiki article referenced below says:

"Deploying artifacts to OSSRH (OSS Repository Hosting provided by Sonatype) requires an account at OSSRH. It is also required to sign all artifacts with GPG. The Eclipse IT team will set this up for the project."

I am hereby asking the Eclipse IT Team to set this up for us. I'm not sure exactly what this will involve since I've never done this before so please be clear about what I need to do.

What is the current bug behavior?

N/A

What is the expected correct behavior?

N/A

Relevant logs and/or screenshots

https://wiki.eclipse.org/Jenkins#How_can_artifacts_be_deployed_to_OSSRH_.2F_Maven_Central.3F

assigned to @fgurr

The following credentials have been added to the BIRT CI instance:

• OSSRH
• GPG

The process for allowing deployments to OSSRH has been started. We are currently waiting for https://issues.sonatype.org/browse/OSSRH-79411 to be resolved.

https://issues.sonatype.org/browse/OSSRH-79411 is resolved now.

The default Maven settings contain a server definition named 'ossrh' to let you upload things to Sonatype's server. This server id should be used in a distributionManagement repository somewhere specifying the URL. See http://central.sonatype.org/pages/ossrh-guide.html#releasing-to-central and http://central.sonatype.org/pages/ossrh-guide.html#ossrh-usage-notes for details.

The GPG passphrase is also configured (encrypted) in the settings (as described at https://maven.apache.org/plugins/maven-gpg-plugin/usage.html#Configure_passphrase_in_settings.xml). It's recommended to use the maven-gpg-plugin.

See also https://wiki.eclipse.org/Jenkins#How_can_artifacts_be_deployed_to_OSSRH_.2F_Maven_Central.3F

Let us know when you promoted your first release so we can comment on https://issues.sonatype.org/browse/OSSRH-79411. Or you can do this yourself.

closed

reopened

I have the maven-gpg-plugin in my root pom:

				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-gpg-plugin</artifactId>
					<version>1.5</version>
					<executions>
						<execution>
							<id>sign-artifacts</id>
							<phase>verify</phase>
							<goals>
								<goal>sign</goal>
							</goals>
						</execution>
					</executions>
				</plugin>

The build is failing:

[INFO] --- maven-gpg-plugin:1.5:sign (sign-artifacts) @ org.eclipse.birt-parent ---
gpg: directory '/home/jenkins/.gnupg' created
gpg: keybox '/home/jenkins/.gnupg/pubring.kbx' created
gpg: no default secret key: No secret key
gpg: signing failed: No secret key

...

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-gpg-plugin:1.5:sign (sign-artifacts) on project org.eclipse.birt-parent: Exit code: 2 -> [Help 1]

Is there anything else you need to know?

Please follow the instructions here: https://wiki.eclipse.org/Jenkins#How_can_artifacts_be_deployed_to_OSSRH_.2F_Maven_Central.3F and make sure to use maven-gpg-plugin version 1.6.

Thanks Frederic. That seems to have fixed the publishing issues.

closed

reopened

There were a number of unrelated issues we had to solve but now the project is building on ci.eclipse.org without error. However it's been 24 hours but I haven't seen org.eclipse.birt appear on s01.oss.sonatype.org in staging, snapshots, or releases. Am I looking for the right thing? The sonatype docs say to log in to ossrh but I can't because I don't know the credentials. How can I debug this process?

According to the JIRA ticket at OSSRH, permissions are set up for oss.sonatype.org not s01.oss.sonatype.org. I've tried to login to the Nexus UI on both sites and the BIRT credentials only work on oss.sonatype.org.

Apart from that, I did not find any reference to the nexus-staging-maven-plugin in the console (https://ci.eclipse.org/birt/job/birt_4.9.0_maven/14/console) log which indicates that artifacts were uploaded or that there was an attempt (that should have failed) at least.

I had specified s01.oss.sonatype.org in the nexus-staging-maven-plugin and distributionManagement. I change it to oss.sonatype.org and try it again. I'll keep the ticket open for now.

After building with oss.sonatype.org in nexus-staging-maven-plugin and distributionManagement I find nexus-staging-maven-plugin on only one line:

[INFO] ... total of 287 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin

oss.sonatype.org is only in my commit message.

With debug output turned on, both can be found in lots of debug lines. Build #15 has debug output and #16 does not. I still don't see org.eclipse.birt in oss.sonatype.org staging, snapshots, or runtime. org.eclipse.birt.runtime exists but it's an older version and has been there a long time. It's been an hour and 50 minutes since build 15.

The nexus-staging-maven-plugin (same for maven-deploy-plugin) are only executed in the deploy phase, which seems to be missing in the Maven call.

See also: https://github.com/sonatype/nexus-maven-plugins/tree/main/staging/maven-plugin

Thanks. I see that someone changed the phase to "deploy" this morning and now I see everything in snapshots. Now I need to get it into releases and into maven central. The sonatype doc describes logging into ossrh to accomplish this, which I can't do. Update: I found the place where it says to remove "-SNAPSHOT" from the version number. I'll do that.

I assume you are referring to this documentation: https://central.sonatype.org/publish/release/#locate-and-examine-your-staging-repository

There are two ways of "releasing" from OSSRH to Maven Central.

• a) you can create an OSSRH account (https://issues.sonatype.org/secure/Signup!default.jspa) and ask for permissions for your user on the JIRA issue (https://issues.sonatype.org/browse/OSSRH-79411. With that you can access the Nexus UI at oss.sonatype.org.
• b) you can release via the nexus-staging-maven-plugin (see https://github.com/sonatype/nexus-maven-plugins/tree/main/staging/maven-plugin#release, see also the rc-* CLI commands)

I was referring to this:

https://central.sonatype.org/publish/publish-maven/#nexus-staging-maven-plugin-for-deployment-and-release

I don't believe I can use option a because the OSSRH account is the one that corresponds to the org.eclipse groupId which is why this ticket was created. You added the credentials to settings.xml on the ci.eclipse.org server but I don't have access to them as far as I know.

My understanding is the "deploy" goal should work if autoReleaseAfterClose is set to true.

I don't believe I can use option a because the OSSRH account is the one that corresponds to the org.eclipse groupId which is why this ticket was created. You added the credentials to settings.xml on the ci.eclipse.org server but I don't have access to them as far as I know.

Multiple users can get permissions to a groupID. That's how other projects are handling it.

My understanding is the "deploy" goal should work if autoReleaseAfterClose is set to true.

After an initial manual "release", that's how it works. You can either do that first release manually with option a), let us handle it or comment on the Jira ticket and let SonaType staff handle it.

I added a comment to https://issues.sonatype.org/browse/OSSRH-79411 asking for release permissions for sschafer@innoventsolutions.com but since I didn't create the ticket I don't know if they'll honor it. I'll let you know if there's a problem.

It should not be problem, they might ask for confirmation from our side though.

Yes you are right:

https://issues.sonatype.org/browse/OSSRH-79411

"Please have someone who already has publisher permissions on this groupId add a comment here to validate your request."

Done

Thanks.

Do I still need to create a new ticket at sonatype to start the publishing process? When I access the Nexus UI I still don't see anything in the staging area, although everything did get published to snapshots.

You will need to deploy a "Release" version (a version without "-SNAPSHOT"). Snapshots won't be published to Maven Central AFAIK.

I was able to get the build to work with a combination of tycho-versions-plugin and a shell script to get rid of "-SNAPSHOT". Now the build is failing because of staging rules failure, but it doesn't tell me what the failure is:

Waiting for operation to complete...
.............................

[INFO] Remote staged 1 repositories, finished with success.
[INFO] Remote staging repositories are being released...

Waiting for operation to complete...
...................................................................................................
[WARNING] TIMEOUT after 300.5 s

[ERROR] 
[ERROR] Nexus Staging Rules Failure Report
[ERROR] ==================================
[ERROR] 
[ERROR] 

It might not like my developers section:

	<developers>
		<developer>
			<name>Contributors to BIRT</name>
			<email>various</email>
			<organization>various</organization>
			<organizationUrl>various</organizationUrl>
		</developer>
	</developers>

How can I find out why it's failing?

Update: maybe this is because of the timeout. I'll retry. It might be more appropriate for me to post something on sonatype if it continues.

A timeout sounds like a legit reason for an error.

As for the errors in #31, please be aware that Maven artifacts can only be released once. You can't overwrite a released version. Only -SNAPSHOT versions can be overwritten.

Closing. Please reopen if something is still missing.

closed