maven-central-publish

Provides a standardized Maven workflow to publish Java artifacts to Maven Central using GPG signing and the modern Central Portal plugin.

Security Scan

The skill's instructions, templates, and requirements are consistent with a Maven Central publishing workflow; nothing in the package appears to be doing unrelated or hidden actions, though the guidance contains some security-weak practices (plaintext passphrases) that users should avoid or harden before use.

Purpose & Capability

Name/description match the content: instructions, pom/templates, and advice all relate to publishing artifacts to Maven Central using GPG signing and the central-publishing plugin. Declared required binaries (maven, gpg) appear in a metadata block and the README references openjdk as well — all appropriate for the stated purpose.

Instruction Scope

SKILL.md stays on-topic (install maven/gnupg/openjdk, configure GPG loopback, populate ~/.m2/settings.xml, add plugins to pom, run mvn deploy). It does not instruct reading unrelated host files or exfiltrating data. However, it recommends storing sensitive credentials (user token and GPG passphrase) directly in ~/.m2/settings.xml which is a risky practice and should be avoided or replaced by secure alternatives.

Install Mechanism

This is an instruction-only skill with no install spec and no code files to execute — lowest install risk. The included apt-get snippets are examples (not automated installers) and reference common package sources. No downloads from untrusted external URLs are present.

Credentials

The skill requests no environment variables or external credentials in its metadata, which is proportionate. The instructions do, however, ask the user to place the Central Portal user token and the GPG passphrase in ~/.m2/settings.xml (plaintext). That is proportional to publishing but security-sensitive — storing secrets in plain files increases risk and better alternatives exist (Maven settings encryption, CI secret stores, gpg-agent, or prompting via secure pinentry).

Persistence & Privilege

Skill is not always-enabled, has normal user-invocable/autonomous settings, and does not request modification of other skills or system-wide agent settings. No privilege escalation or persistent background components are requested.

Assessment

This skill appears to be exactly a Maven Central publish guide with matching templates — it is internally coherent. Before using it, avoid copying secrets verbatim into ~/.m2/settings.xml: do not store GPG passphrases or user tokens in plaintext. Prefer Maven settings encryption (settings-security.xml), CI secret storage, or using gpg-agent/loopback pinentry securely so the passphrase is not stored on disk. Review the templates and replace placeholder tokens with secret references managed by your CI or secret manager. Also be aware the example apt-get commands need root privileges and are just suggestions — run them only on machines you control. If you need higher assurance, request the skill author to provide documentation showing secure, non-plaintext handling of credentials (or to switch to recommending encrypted settings or environment-injected secrets).

Maven Central Publish Skill

This skill provides a standardized workflow for publishing Java/Kotlin libraries to the Maven Central Repository using the modern Central Portal (via central-publishing-maven-plugin).

📋 Prerequisites

1. Central Portal Account: Sign up at central.sonatype.com.
2. Namespace Verified: You must have verified your groupId (e.g., io.github.username or com.yourdomain) in the portal.
3. User Token: Generated from the Central Portal (My Account -> Generate User Token).

🛠️ Environment Setup

1. Install Tools

Ensure maven, gnupg, and openjdk-17+ are installed.

# Ubuntu/Debian
apt-get install -y maven gnupg openjdk-17-jdk

2. GPG Configuration (Critical)

Maven requires GPG signing. For automated/headless environments, Loopback Pinentry is required.

# 1. Generate Key (if none exists)
gpg --gen-key

# 2. Configure Loopback (Prevent UI prompts)
mkdir -p ~/.gnupg
echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
gpg-connect-agent reloadagent /bye

# 3. Publish Key
gpg --list-keys # Get your Key ID (last 8 chars or full hex)
gpg --keyserver keyserver.ubuntu.com --send-keys <KEY_ID>

3. Maven Settings (~/.m2/settings.xml)

Configure your Central Portal credentials.

<settings>
  <servers>
    <server>
      <id>central</id>
      <username>USER_TOKEN_USERNAME</username>
      <password>USER_TOKEN_PASSWORD</password>
    </server>
  </servers>
  <profiles>
    <profile>
      <id>release</id>
      <activation>
        <activeByDefault>false</activeByDefault>
      </activation>
      <properties>
        <gpg.executable>gpg</gpg.executable>
        <gpg.passphrase>YOUR_GPG_PASSPHRASE</gpg.passphrase>
      </properties>
    </profile>
  </profiles>
</settings>

📦 Project Configuration (pom.xml)

Your project MUST meet the Quality Requirements:

1. Coordinates: groupId, artifactId, version.
2. Metadata: name, description, url, licenses, developers, scm.
3. Plugins: Javadoc, Source, GPG, and Central Publishing.

Recommended Plugin Configuration

Add this to your <build><plugins> section:

<!-- 1. Source Plugin -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-source-plugin</artifactId>
    <version>3.3.0</version>
    <executions>
        <execution>
            <id>attach-sources</id>
            <goals><goal>jar-no-fork</goal></goals>
        </execution>
    </executions>
</plugin>

<!-- 2. Javadoc Plugin -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-javadoc-plugin</artifactId>
    <version>3.6.3</version>
    <configuration>
        <doclint>none</doclint> <!-- Prevent strict checks failing build -->
        <failOnError>false</failOnError>
    </configuration>
    <executions>
        <execution>
            <id>attach-javadocs</id>
            <goals><goal>jar</goal></goals>
        </execution>
    </executions>
</plugin>

<!-- 3. GPG Plugin (Best Practice: wrap in 'release' profile) -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-gpg-plugin</artifactId>
    <version>3.1.0</version>
    <configuration>
        <gpgArguments>
            <arg>--pinentry-mode</arg>
            <arg>loopback</arg>
        </gpgArguments>
    </configuration>
    <executions>
        <execution>
            <id>sign-artifacts</id>
            <phase>verify</phase>
            <goals><goal>sign</goal></goals>
        </execution>
    </executions>
</plugin>

<!-- 4. Central Publishing Plugin (The Magic Sauce) -->
<plugin>
    <groupId>org.sonatype.central</groupId>
    <artifactId>central-publishing-maven-plugin</artifactId>
    <version>0.7.0</version>
    <extensions>true</extensions>
    <configuration>
        <publishingServerId>central</publishingServerId>
        <!-- autoPublish: set to true to skip manual button click in portal -->
        <autoPublish>false</autoPublish> 
    </configuration>
</plugin>

🚀 Deployment

Run the deploy command with the release profile active:

mvn clean deploy -P release

Success Indicators:

• [INFO] Uploaded bundle successfully...
• [INFO] Deployment ... has been validated.

If autoPublish is false (recommended for first time), log in to central.sonatype.com, review the deployment, and click Publish.

❓ Troubleshooting

Error	Cause	Fix
401 Unauthorized	Invalid User Token in settings.xml	Generate new token in Central Portal. Ensure server ID matches.
GPG signing failed	No pinentry / wrong passphrase	Use pinentry-mode loopback config; Check gpg-agent.
Javadoc generation failed	Strict HTML checks	Add <doclint>none</doclint> to javadoc plugin config.
Invalid coordinates	GroupId mismatch	Ensure pom.xml groupId matches verified namespace in Portal.