Sources missing from central mvnrepository since RELEASE 2.1.4
janderssonse opened this issue · 7 comments
Describe the bug
Since release 2.1.4, the sources jar is missing from mvncentral. This breaks earlier behaviour for example for any tool expecting to find the sources along with the regular release jar.
Sample
In all versions in central mvnrepository up until 2.1.4 the sources jar can be found. see for example 2.1.3
https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-openfeign/2.1.3.RELEASE/
In versions after that it is missing, example
https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-openfeign/2.2.1.RELEASE/
Thanks for reporting this. The triage confirms the issue exists and is a global one (same happens for other projects, for example in sleuth starter). Transferring issue to sc-build project.
Does a pom artifact have sources?
I don't think this is an issue anymore
@spencergibb It is still an issue, have a look at https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-openfeign/4.1.0/ - A sources jar is expected and the overall standard java maven publishing convention is that the sources jar is also published - see other projects in the ecosystem, examples https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-cli/3.1.0/ or even other prominent java projects. https://repo1.maven.org/maven2/org/junit/jupiter/junit-jupiter-engine/5.10.1/ . I can't understand the rationale for not doing this here ( and can't find anything in the documentation either regarding why this project should choose not to). If no rationale can be found, I would assume it is a bug, and a small misconfiguration in the publishing configuration.
I vote for reopening so it will have a better chance of being seen and fixed.
A starter is a pom and there are no sources
@spencergibb Yes. you are correct,. sorry my bad :) Looking into the jar, for the versions where it used to be published (pre 2.1.3) it was only containing metadata, poms and as you say no real sources which makes it technically correct to not have that artifact - I agree with you now.
The whole rationale for opening this was, if I recall: I used an source collector tool if i recall, breaking the usage (this was a while ago) when it could not find sources jar to import any longer - but that was now, I see, a bug in that tool. Sadly I don't remember which tool it was, hmm. Anyway, keep this closed. Thanks for the quick response and have a nice christmas!