From 8979ec91a48801218f3281fd4ee650c5f84c202a Mon Sep 17 00:00:00 2001 From: Seth Tisue Date: Thu, 19 Dec 2024 08:40:14 -0800 Subject: [PATCH 1/2] Sonatype requires user token now --- readme.md | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/readme.md b/readme.md index 0fc96d4..6d38025 100644 --- a/readme.md +++ b/readme.md @@ -63,10 +63,9 @@ Hi, I would like to publish under the groupId: io.github.sbt. It's my GitHub account https://github.com/sbt/ ``` -### Optional: create user tokens - -If you prefer not to save your actual username and password in GitHub Actions -settings below, generate your user tokens: +Sonatype no longer allows using your actual username and password to +authenticate during publishing. Instead, you must use the name and password +from your "user token". - login to https://s01.oss.sonatype.org/ (or https://oss.sonatype.org/ if your Sonatype account was created before February 2021), @@ -246,14 +245,10 @@ gpg --armor --export-secret-keys %LONG_ID% | openssl base64 *If you try to display the base64 encoded string in the terminal, some shells (like zsh or fish) may include an additional % character at the end, to mark the end of content which was not terminated by a newline character. This does not indicate a problem. Note for Windows - delete any linebreaks or spaces when copying the encoded string from terminal.* -- `SONATYPE_PASSWORD`: The password you use to log into - https://s01.oss.sonatype.org/ (or https://oss.sonatype.org/ if your Sonatype - account was created before February 2021). Alternatively, the password part of - the user token if you generated one above. -- `SONATYPE_USERNAME`: The username you use to log into - https://s01.oss.sonatype.org/ (or https://oss.sonatype.org/ if your Sonatype - account was created before 2021). Alternatively, the name part of the user - token if you generated one above. +- `SONATYPE_PASSWORD`: The password part of your Sonatype + user token (not the account password!). +- `SONATYPE_USERNAME`: The username part of your Sonatype + user token (not the account username!). - (optional) `CI_RELEASE`: the command to publish all artifacts for stable releases. Defaults to `+publishSigned` if not provided. - (optional) `CI_SNAPSHOT_RELEASE`: the command to publish all artifacts for a @@ -410,16 +405,12 @@ If you prefer to keep most of the information in a git branch instead, you can j As of February 2024, Sonatype has released a new portal, called Sonatype Central. Users can configure their libraries to be published via this portal by adding the following to `build.sbt`: -```sbt +```sbt import xerial.sbt.Sonatype.sonatypeCentralHost ThisBuild / sonatypeCredentialHost := sonatypeCentralHost ``` -Users can generate a two-part token, containing username and password values, in their [account](https://central.sonatype.com/account) and then set these to the _SONATYPE_USERNAME_ and _SONATYPE_PASSWORD_ environment variables. All other steps should then work as documented. - - - ### How do I disable publishing in certain projects? Add the following to the project settings (works only in sbt 1) From d531e3abe1b1a71adfafaac78ed55377e3d035c0 Mon Sep 17 00:00:00 2001 From: Seth Tisue Date: Fri, 20 Dec 2024 13:44:11 -0800 Subject: [PATCH 2/2] Update readme.md Co-authored-by: eugene yokota --- readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 6d38025..55c44d5 100644 --- a/readme.md +++ b/readme.md @@ -246,7 +246,7 @@ gpg --armor --export-secret-keys %LONG_ID% | openssl base64 may include an additional % character at the end, to mark the end of content which was not terminated by a newline character. This does not indicate a problem. Note for Windows - delete any linebreaks or spaces when copying the encoded string from terminal.* - `SONATYPE_PASSWORD`: The password part of your Sonatype - user token (not the account password!). + [OSSRH token](https://central.sonatype.org/publish/generate-token/), generated on your Nexus server https://s01.oss.sonatype.org/ or https://oss.sonatype.org/ (not the account password!). - `SONATYPE_USERNAME`: The username part of your Sonatype user token (not the account username!). - (optional) `CI_RELEASE`: the command to publish all artifacts for stable