Add support for Sonatype snapshot publishing to maven-publish - #639
paul-aiyedun wants to merge 1 commit into
Conversation
* Add `maven_snapshot_publish.sh` and its helpers. Deploys via `mvn sign-and-deploy-file` to the Sonatype snapshot repository so Nexus timestamps each publish and updates `maven-metadata.xml`. * Branch destination inside `maven-publish.yaml` on `rapids-is-release-build`. Maven Central for release tags, the Sonatype snapshot repository otherwise. * Sign both release and -SNAPSHOT trees in one `prepare_maven_bundle.sh` invocation. * Reject release-shaped inputs on the snapshot publish path, so a bad build cannot land release coordinates in the snapshot repository.
paul-aiyedun
added
feature request
|
This workflow update was tested as part of NVIDIA/cudf#24134 (comment). |
| -Dmaven.wagon.http.retryHandler.count=3 | ||
| -DretryFailedDeploymentCount=3 | ||
| -s "${settings_file}" | ||
| org.apache.maven.plugins:maven-gpg-plugin:3.1.0:sign-and-deploy-file |
There was a problem hiding this comment.
The -SNAPSHOT sign with maven-gpg-plugin has a potential issue of: publishes signature metadata using the base -SNAPSHOT version, while Maven gives the artifact a timestamped snapshot name, e.g.,
cudf-26.12.0-timestamps1-1.jar --> cudf-26.12.0-SNAPSHOT.jar.asc instead of cudf-26.12.0-timestamps1-1.jar.asc
cudf-26.12.0-timestamps2-2.jar --> cudf-26.12.0-SNAPSHOT.jar.asc instead of cudf-26.12.0-timestamps2-3.jar.asc
cudf-26.12.0-timestamps3-3.jar- -> cudf-26.12.0-SNAPSHOT.jar.asc instead of cudf-26.12.0-timestamps3-3.jar.asc
That means many timestamped JARs share the same SNAPSHOT.jar.asc file.
This is not a major issue because signature files are neither required nor guaranteed to correspond to
each timestamped JAR for the snapshots deployment.
Only release deployments require correct one-to-one(not multi-to-one) signatures, and this issue does not affect release deployments. Release artifacts are immutable, so multiple timestamped JARs do not share a single SNAPSHOT.jar.asc file.
So either ignore this multi-to-one signature files' mismatching, as what the current change does
or just NOT sign the SNAPSHOT JARs
2 participants
Add
maven_snapshot_publish.shand its helpers. Deploys viamvn sign-and-deploy-fileto the Sonatype snapshot repository so Nexus timestamps each publish and updatesmaven-metadata.xml.Branch destination inside
maven-publish.yamlonrapids-is-release-build. Maven Central for release tags, the Sonatype snapshot repository otherwise.Sign both release and -SNAPSHOT trees in one
prepare_maven_bundle.shinvocation.Reject release-shaped inputs on the snapshot publish path, so a bad build cannot land release coordinates in the snapshot repository.
Closes https://github.com/rapidsai/build-infra/issues/384