[libvirt] [libvirt-java] Upload 0.4.8 to central Maven repository
Daniel Veillard
veillard at redhat.com
Mon Sep 17 12:50:41 UTC 2012
On Mon, Sep 17, 2012 at 02:32:03PM +0200, Wido den Hollander wrote:
> On 17-09-12 14:20, Daniel Veillard wrote:
> >On Mon, Sep 17, 2012 at 10:35:02AM +0200, Wido den Hollander wrote:
[...]
> >>However, maven central didn't fetch 0.4.9 yet. No clue why it ain't
> >>fetching..
> >
> > I wonder where we could get the needed informations ...
> >
> I've been searching and found: http://maven.apache.org/guides/mini/guide-central-repository-upload.html
>
> "Publishing your artifacts to the Central Repository"
>
> That seems to suggest that since January 2010 they no longer sync
> from any location and you should use Sonatype OSS for that.
>
> This seems to be the online way: https://docs.sonatype.org/display/Repository/Sonatype+OSS+Maven+Repository+Usage+Guide
Holy crap ... what a monstruosity.
And the reason:
"Additionally, there is no good mechanism currently for validating the
incoming data via the rsync, and this leads to bad metadata that affects
everyone. "
Put the damn metadata *in the package* and gpg sign it. Either you
trust the key or not is the question, but the problem was solved by rpm
more than a decade ago IMHO !
Not sure Maven is really the way to go that's seems seriously broken.
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel at veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
More information about the libvir-list
mailing list