powered by Jive Software

Publishing of Smack snapshots to oss.sonatype.org

Smack Smack Support
#1

I wanted to test the latest Smack 4.4.4-SNAPSHOT after the open pull requests were merged today (thanks for that!). Unfortunately the -SNAPSHOT versions/builds are no longer published to oss.sonatype.org, the last builds are from sometime in 2020. Is this intentional? The readme still has a link to the snapshots repository.

It would be great if they were available again (also for jxmpp and minidns, they stopped at about the same time). I can help with a draft-PR for jxmpp to build on GitHub Actions, but that would obviously need refinement from a developer with access to the credentials.

Thanks,
Ingo

#2

The snapshots on oss.sonatype.org are manually uploaded by me. I usually do it once in a while. Besides that our Bamboo instance performes nightly builds and pushes those to our Archiva instance at Apache Archiva (see Collection: /org/igniterealtime/smack). I know it’s confusing and should be better documented in Smack’s README. :confused:

I assume you are mostly interested in the OSGi functionality that you recently added. Bamboo only builds Smack as of now. For those, I’ve just uploaded snapshot releases to oss.sonatype.org. But note that Smack will not automatically use those releases. You have to explicitly modify your build system to pin those versions.

#3

Hm, okay. Let me rephrase the question then: could you please add automated uploading to oss.sonatype.org?
In case you’re worried about security, you could create one or multiple distinct Sonatype-account(s), and, if necessary, restrict them to uploading snapshots only.

I’ll see what I can do with the Archiva repo in the meantime.

#4

Two things made automatic uploads to oss.sonatype.org not really attractive to me (not sure if they are still valid):

  • I have to add my personal sonatype credentials to bamboo
  • snapshots have a limited retention policy. Whereas artifacts are never deleted from our archiva instance

Those, and the fact that it is easy to add another remote maven repository have previously prevented me from putting more effort into it.

#5
  • I have to add my personal sonatype credentials to bamboo

As I mentioned, instead of your personal credentials these can be a specifically created account. We use such an account for Jitsi.

  • snapshots have a limited retention policy. Whereas artifacts are never deleted from our archiva instance

AFAIK this is still true. However, I don’t think it matters for snapshots. If you do want to keep a history, you could deploy to both repositories.

The problem with multiple repositories as a consumer is that you’ll never really know which one you’re ending up with.

#6

How do I get such an account?

That would be my preferred solution.

Right, and given that there Maven artifacts are not really verified¹, you increase your trust base even further.

1: Until someone starts working on MNG-6026.

#7

How do I get such an account?

  • Sign up for a JIRA account (like you’d normally do): Sign up for Jira - Sonatype JIRA
  • Then create a JIRA ticket to request that user to be added to the org.igniterealtime group-id. Preferably create this ticket with your personal account, since that shows you already have access. Ask to allow for -SNAPSHOT uploads only. Here’s the ticket I created for Jitsi back then: https://issues.sonatype.org/browse/OSSRH-16391

For completeness, here’s a link to the complete documentation for entirely new users:
https://central.sonatype.org/publish/publish-guide/

#8

Thanks, I will a have look once I find the time.

But since it is time for a Smack release, I may perform the release first. Unless you wheren’t able to test your changes, especially the OSGi ones, without the snapshots published to OSS sonatype. Is this the case? Or do I get a green light from Jitsi’s sides that the changes are tested and that there is nothing preventing a round of stable jXMPP, MiniDNS, and Smack releases? :slight_smile:

#9

I wasn’t really sure on Tuesday when I last did some changes if all projects had their snapshots published to Sonatype. I’ll check it (late) this evening, making sure to clean all local caches, and report back here.

#10

Seems fine from what I can tell with the published snapshots on Sonatype/Archiva for Jitsi Desktop and Jigasi. :+1:

I don’t know if @Jonathan_Lennox or @damencho have anything to add re. their MUC issue.

#11

It would be great if you could tell me till Wednesday if you need more time testing or if you think it’s ready for a new release round. Thanks :slight_smile:

#12

The only thing I know of is the remove thingy that @Jonathan_Lennox is working on :slight_smile: