Skip redundant checksum files in Maven Central publishing #6380

Activity

1. linear-code commented on Oct 26, 2026

   

   linear-codeBot

   on Oct 26, 2026 – with Linear Code

   More actions

   JAVA-803
2. github-actions

   added

   Platform: Java

   on Oct 26, 2026
3. sentry-junior commented on Oct 26, 2026

   

   sentry-juniorBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Closing as not applicable. Our release pipeline doesn't publish to Maven Central through Gradle, so -Dorg.gradle.internal.publish.checksums.insecure=true would have no effect:

   • make publish runs distZip, which depends on publishToMavenLocal and zips build/libs + build/publications (build.gradle.kts, buildSrc/src/main/java/Publication.kt). Gradle doesn't write checksum files to Maven Local.
   • craft uploads with mvn gpg:sign-and-deploy-file (.craft.yml → scripts/mvnw, Maven 3.6.3), which only generates .md5 and .sha1.
   • Published artifacts confirm this: io/sentry/sentry/8.61.1/ has .asc, .md5, and .sha1 files, but no .sha256 or .sha512.

   Any file-count reduction would need to happen in the craft/Maven deploy step instead.
4. sentry-junior

   closed this as completedon Oct 26, 2026