Missing checksum files when using Gradle maven-publish and signing plugins

user_269447 0
Viewed 470

I have a Java project that makes use of Gradle to build and package. My purpose is to create artifacts that are published to Maven Central.

As a first step, I configured my Gradle project as shown in the following example from the documentation:

https://docs.gradle.org/current/userguide/publishing_maven.html#publishing_maven:complete_example

When I run gradle publishToMavenLocal, I get the following files installed in my local repository:

maven-metadata-local.xml
my-library-1.0.2-SNAPSHOT.jar
my-library-1.0.2-SNAPSHOT.jar.asc
my-library-1.0.2-SNAPSHOT-javadoc.jar
my-library-1.0.2-SNAPSHOT-javadoc.jar.asc
my-library-1.0.2-SNAPSHOT.pom
my-library-1.0.2-SNAPSHOT.pom.asc
my-library-1.0.2-SNAPSHOT-sources.jar
my-library-1.0.2-SNAPSHOT-sources.jar.asc

The files are all OK. The only issue I have is that checksum files (md5 and sha1) are not generated. However, checksum files are a requirement to have artifacts deployed on Maven Central via OSS Sonatype.

How can I generate the missing checksum files? It seems the maven-publish or signing plugins do not have an option for this purpose? what is wrong?

maven-central sonatype maven-publish gradle maven
1 Answers

The solution I found was to use shadow along with ant.checksum:

tasks.withType(Jar) { task ->
    task.doLast {
        ant.checksum algorithm: 'md5', file: it.archivePath
        ant.checksum algorithm: 'sha1', file: it.archivePath
        ant.checksum algorithm: 'sha-256', file: it.archivePath, fileext: '.sha256'
        ant.checksum algorithm: 'sha-512', file: it.archivePath, fileext: '.sha512'
    }
}

Invoking gradle publishShadowPublicationToMavenLocal will generate the signatures as needed, although won't publish them to ~/.m2.

At first I thought those signatures should have been automatic, so I opened https://github.com/johnrengelman/shadow/issues/718 to discuss.

user_1230940
Related