chore: drop optional SHA256/SHA512 checksums from Maven Central deploy - #106
Open
marioserrano09 wants to merge 1 commit into
Open
marioserrano09 wants to merge 1 commit into
marioserrano09 wants to merge 1 commit into
Conversation
Maven Central only requires MD5 + SHA1 checksums per file (SHA256/SHA512 are accepted but explicitly optional per Sonatype's own publishing requirements doc). central-publishing-maven-plugin defaults to generating all four; set checksums=required to generate only the mandatory two. Per component this drops file count from 24 to 16 for a jar-packaged module (-33%), and from 6 to 4 for a pom-packaged aggregator. Verified against a real deploy log (v26.9.0): jar-packaged modules stage jar/sources.jar/javadoc.jar/pom x 6 files each; pom-packaged aggregators (11 of them) correctly already skip javadoc/sources (maven-javadoc-plugin and maven-source-plugin self-skip for packaging=pom) and only stage pom+asc+checksums -- no waste there, this checksums setting is the only available lever without dropping something Central actually requires (sources.jar/javadoc.jar/.asc signatures/.md5+.sha1 are all mandatory for non-pom packaging). Relevant with Maven Central's new per-organization monthly file-count tracking (soft-limit phase now, enforcement starts Oct 1 2026) -- see https://central.sonatype.org/publish/maven-central-publishing-limits/ Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UcARdenC1Sk5EVpkzboH9W
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Maven Central now tracks monthly file-count usage per organization (soft-limit phase since
June 16 2026, enforcement starts October 1 2026 — docs).
Our last release (v26.9.0) landed at ~1002 files, already over the current 1000 threshold shown
in the Usage Center.
What
Set
<checksums>required</checksums>oncentral-publishing-maven-plugin— Central's ownrequirements doc only mandates MD5+SHA1
per file; SHA256/SHA512 are explicitly optional. The plugin defaults to generating all four.
What I checked before touching this
sources.jar/javadoc.jar: mandatory for any non-pompackaging, verifiedagainst Sonatype's requirements doc.
.ascsignatures or.md5/.sha1: also mandatory.v26.9.0 deploy log --
javadoc:jar/source:jarself-skip forpackaging=pom(producenothing), those modules only ever stage
.pom+.pom.asc+ checksums.So
checksums=requiredis the only available reduction that doesn't drop something Centralactually requires.
Impact
Per jar-packaged module: 24 → 16 files (-33%). Per pom-packaged aggregator: 6 → 4. Across ~51
modules that's roughly -340 files per release.
Further reduction (not in this PR, needs a product call)
excludeArtifactscould stop publishing modules nobody consumes as a standalone Mavendependency, if any exist -- that changes what's actually published, not just metadata overhead,
so it needs someone who knows the intended public API surface to decide, not something to
infer from the build alone.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UcARdenC1Sk5EVpkzboH9W