#1551 Migrate packages from Bintray to Maven Central

[Aaron Madlon-Kay]

Bintray is shutting down. Current data will remain available only until May 1, 2021. After that, OmegaT will no longer be buildable for users who don't already have the affected packages in their local cache.

We use the following packages on Bintray:

• Published by omegat-org
  • jmyspell-core
  • lib-mnemonics
  • htmlparser
  • gnudiff4j
  • lucene-core (see [bugs:#813])
  • vldocking
  • lucene-gosen (see [bugs:#814])
  • juniversalchardet (disused)
  • OmegaT
• Published by amake
  • SuperTMXMerge
  • DesktopSupport
• Published by dictzip
  • dictzip-lib

The ones still in use will need to be migrated to another host. Which host to use is undecided. Candidates:

• Maven Central via Sonatype OSSRH
• GitHub Packages
• Gitlab Packages & Registries

[Hiroshi Miura]

Dependency: dictzip-java is also hosted on bintray/JCenter that should be also migrated and omegat should see it.

[Aaron Madlon-Kay]

Thanks for pointing that out.

[Hiroshi Miura]

Gitlab package & registory may be alternative.

[Aaron Madlon-Kay]

Thanks for that. I'm worried about Maven Central (cumbersome process) and GitHub (restrictive transfer limits outside of GitHub) so it's good to have some more options.

[msoutopico]

A friend has recommended https://jitpack.io/, in case it helps.

[Hiroshi Miura]

They claims "jitpack is always free for Open-Source". It seems a candidate.

[Hiroshi Miura]

Jitpack trial report

I've tried jitpack.io on the project EB4j https://github.com/eb4j/eb4j

howto

1. I've just refer jitpack.io repository on omegat-plugin-epwing project(user project).

   repositories { maven { url = uri("https://jitpack.io") } }

2. Reload gradle project of user project: omegat-plugin-epwing

3. jitpack run automatically see git repository and build Just-In-Time manner, and then provide artifact to user project.
4. When see project page on https://jitpack.io/#eb4j/eb4j, I can see a build log. https://jitpack.io/com/github/eb4j/eb4j/v2.0.0/build.log

It is easy for library projects hosted on github, that produce just a library artifact.
jitpack.io seems to see Github releases to get version tag/commit id.

evaluation

I cannot succeed to use a package on jitpack.io in my downstream project.
I give up to use jitpack.io now.

[Hiroshi Miura]

Jitpack trial report(2)

For build dependency, I've checked capability with jitpack.io.
It is not good for OmegaT delivery process.

DesktopSupport become a failure on jitpack build process.
https://jitpack.io/#amake/desktopsupport

dictzip and supertmxmerge have passed the build.
https://jitpack.io/#amake/supertmxmerge
https://jitpack.io/#dictzip/dictzip-java

A modification is like as follows;

--- a/build.gradle
+++ b/build.gradle
@@ -67,7 +67,10 @@ sourceSets {
 }

 repositories {
-    jcenter()
+    mavenCentral()
+    maven {
+        url 'https://jitpack.io'
+    }
     maven {
         url 'https://dl.bintray.com/omegat-org/maven'
     }
@@ -124,7 +127,7 @@ dependencies {
         implementation 'net.loomchild:maligna:3.0.0'

         // Dictionary
-        implementation 'org.dict.zip:dictzip-lib:0.9.1'
+        implementation 'com.github.dictzip:dictzip-java:0.9.1'
         implementation 'com.github.takawitter:trie4j:0.9.8'

         // Encoding dectection
@@ -163,7 +166,7 @@ dependencies {
         implementation 'org.tmatesoft.svnkit:svnkit:1.8.14'

         // Team project conflict resolution
-        implementation 'org.madlonkay.supertmxmerge:supertmxmerge:2.0.1'
+        implementation 'com.github.amake:supertmxmerge:2.0.1'

         // Credentials encryption
         implementation 'org.jasypt:jasypt:1.9.3'

[Aaron Madlon-Kay]

Thank you so much for your investigations! It's very helpful.

[Hiroshi Miura]

PackageCloud.io is another candidate.
https://packagecloud.io/pricing

they said

packagecloud supports Open Source Projects
Thousands of open source projects rely on packagecloud to distribute
their software around the world for free.

Contact us to start distributing your open source project with packagecloud

[Hiroshi Miura]

Github package repository

Currently they don't have a configuration to publish package to public without authentication. User who want to use published package need to authenticate on Github with read permission for target package repository.

Example for publish: https://github.com/eb4j/eb4j
Example for reference: https://github.com/miurahr/omegat-plugin-epwing

[Hiroshi Miura]

For OSS project, github package repository is available to ALL Github users.
A dummy gh account, which is not a member of group of the repository, can access public repository with a credential of dummy account.

It means that developers and translation team admins, who want to use package from github package repository, should register github service and authenticate its id/pass_or_token to download our package.

It is ok for plugin developers who have already used github.
It is ok for translation admins who use github as team repository and gh actions as a QA process by using Gradle's omegat plugin.

It may be acceptable for OmegaT build process, because known core developers have already been a github user.

[Hiroshi Miura]

Gitlab packages

I've tried gitlab packages with following gradle configuration, but not succeeded because of server error for upload.

publishing {
    repositories {
            maven {
            // FIXME: not working: error with 415 unsupported media type
            name = "GitLabPackages"
            url = "https://gitlab.com/api/v4/groups/dictzip/-/packages/maven"
            credentials(HttpHeaderCredentials) {
                def jobToken = System.getenv("CI_JOB_TOKEN")
                if (jobToken != null) {
                    // GitLab CI
                    name = "Job-Token"
                    value = System.getenv("CI_JOB_TOKEN")
                } else {
                    name = "Private-Token"
                    value = System.getenv("GITLAB_TOKEN")
                }
            }
            authentication {
                header(HttpHeaderAuthentication)
            }
        }
    }
}

[Hiroshi Miura]

Azure Artifacts is another alternative.
It costs free up-to 2GB packages.

https://docs.microsoft.com/en-us/azure/devops/artifacts/get-started-maven?view=azure-devops

[Hiroshi Miura]

MavenCentral/OSSRH/sonatype

I've just started to trying register dictzip project. to sonatype OSSRH repository, that is a way to publish it on MavenCentral.
https://issues.sonatype.org/browse/OSSRH-65704
I'd like to feedback my experience here.

Sonatype upgraded their service n Febrary, because many developers who have used JCenter register to MavenCenteral.
They now run nexus https://s01.oss.sonatype.org/ with better resources.

[Hiroshi Miura]

You can find a process and code how to publish on OSSRH/MavenCentral

• project: https://github.com/eb4j/eb4j
• Sonatype jira ticket: https://issues.sonatype.org/browse/OSSRH-65703

I've used a nexus publish plugin for gradle and github actions for process automation.

id "io.github.gradle-nexus.publish-plugin" version "1.0.0"

• configuration for signing, accepting key from environment.
  https://github.com/eb4j/eb4j/blob/master/build.gradle#L138-L162

• automate a publish process by github actions and project secrets configuration.
  https://github.com/eb4j/eb4j/blob/master/.github/workflows/build-release-and-upload.yml#L40-L49

[Hiroshi Miura]

I'd like to propose to add MavenCentral and Github Packages.
https://github.com/omegat-org/omegat/pull/79

[Aaron Madlon-Kay]

Thanks very much for your reports, Hiroshi.

I am wary of any host other than Maven Central disappearing the same way JCenter will soon. So I am looking to move all of our packages to Maven Central via Sonatype OSSRH. I've submitted tickets for my own packages and if all goes well I will move the OmegaT packages as well.

• OSSRH-67328 DesktopSupport
• OSSRH-67327 SuperTMXMerge

[Aaron Madlon-Kay]

I thought about implementing [#1299] to avoid having to move some of the dependencies to Maven Central, but I decided that it's important to move everything so that historical versions of OmegaT can be built without too much trouble.