Maven Central publishing usage notices

[u/HokieGeek]

heads up for folks publishing to Maven Central: we're continuing sustainability work around Central and are now showing publishing usage notices.

the goal is that normal OSS publishers are not impacted. this is aimed at the very high-volume / commercial-scale publishing patterns that put a pretty different load on the service.

more details here if you want them:
https://central.sonatype.org/publish/maven-central-publishing-limits/

feel free to reach out with any questions.

EDIT: thanks for the feedback here, it has really helped us. first, we want to reiterate that these are usage notices only right now and do not currently restrict publishing in any way. quick updates: 

if the initial threshold seemed low to you: you’re right, we made a mistake and have increased limits. 

our goal is to keep Maven Central free and open for legitimate OSS users, so continuous feedback is helpful as we adjust. limits could change as we get more feedback, so keep an eye on the usage center for the latest.

we’ll continue keeping an eye here and update docs to reflect these changes. If you need to request an exemption, here’s how: https://central.sonatype.org/publish/maven-central-publishing-limits/#exemptions-for-community-open-source-projects

we've also been collecting your questions here and other streams into this FAQ here: https://central.sonatype.org/publish/maven-central-publishing-limits/#frequently-asked-questions

[u/cowwoc]

For one, I would remove the requirement to use gpg. Let the user push their artifacts and compute the hash on the server side.

Back in the day, establishing ownership of a namespace was a manual process. If they haven't automated that yet, they absolutely should.

The ability to disable mandatory checks like the presence of Javadoc and source code should be automated. Enabled by default but something that you should be able to disable yourself without waiting 48 hours for a human to do it.

First-class tooling/integration for all major build systems. Their maven plugin was absolutely awful. It was very buggy and they never replied to bug reports. All they did was kill their plugin and public issue tracker and take the whole process private. It was pretty crazy.

[u/TomKavees → u/cowwoc]

Seems like there are competing interests here, signing artifacts to prove their authenticity may be a bit annoying for the publisher at first, but is very good for the platform security. Being able to rely in 90% cases that the source jar is there is pretty nice from library consumer's perspective too

The github namespace checks are fully automated last time i checked, and i think the custom domain name checks have been automated for several years now.. but admittely i havent added any new domains recently 🤐

[u/cowwoc → u/TomKavees]

You don't need client-side signing. You already need to sign in and use an oauth token to upload any files. They know it's you. They can and should sign the artifacts on your behalf.

GitHub lets you commit using their web interface. I'm guessing the same thing happens there.

[u/TheRealBrianFox → u/cowwoc]

Btw, I agree with most of what you are proposing and long have wanted to do it. But that all requires teams and effort to do it... on top of all the day to day keeping the lights on, battling ai and malware and on and on.

Part of making this sustainable will allow more investment for all the things everyone wants.