Inquiry about Project Activity and Future Plans about javahamcrest

[mkurz]

Can I be added to the publisher?

Hmm... In the light of the xz attack (https://research.swtch.com/xz-timeline) I think it might be a good idea to check on the background of people who come up and want to maintain a repo out of the blue....
@olibye does not have a single commit in this repo (https://github.com/hamcrest/JavaHamcrest/commits?author=olibye) and did not open a single issue nor pull request (https://github.com/hamcrest/JavaHamcrest/issues?q=author%3Aolibye).

I am just saying it might be a good idea to do a bit of a background check of the people's track record in open source in general before giving them commit/release permissions...

[olivergondza]

@tumbarumba, @nhojpatrick, any update on this one? We all love and depend on hamcrest, and I am sure there is plenty of people that would be keen on helping out, if that is needed.

Thanks!

[olibye]

Yes, I'm active again. My first task will be to move to GitHub actions as free travis support was dropped

[tumbarumba]

Good point @mkurz. xz was a pretty big wake up to potentially malicious actors. However, I am familiar with Oli and his work on jmock, one of the libraries that inspired Hamcrest.

... in fact, I just remember Oli already has commit rights in this project. I guess Steve or Nat added you in, @olibye?

[olibye]

Hi @tumbarumba @nhojpatrick, who published the last maven central release?

Can I be added to the publisher? I'd like to automate the publishing similar to that of jMock. On the basis that it should improve release cadance.

[tumbarumba]

I was the last publisher, way back when. I'd be happy to help set you up as a publisher. It's been a long time, but looking at https://central.sonatype.org/publish/publish-guide/ I think you have to have accounts set up. I assume you already have this with your jMock work. Note that at one stage I did have Gradle push the binary to Sonatype. I recall that there was still a manual approve step somewhere (I'm forgetting details). Can you see how we can add you into JavaHamcrest as a publisher?

I'm quite interested in picking up Hamcrest fixes and improvements again. It's been a long time niggle with me that I haven't been able to spend time. I think I'm at a place where I can spend a small amount of time each week pushing forward on making Hamcrest better. I'd be interested in discussing how we can pick apart and prioritise work. Happy to chat in more detail, either here on on socials (see exubero dot com for my contact details)

[olibye]

Yeah, I was added ages ago by Steve or Nat. I've recently ported my original jmock travis work to github actions and was looking to do the same here. It makes pushing out new releases easier with all the standard github controls we know and love. I already have the sonatype accounts for publishing jMock, but they have to be linked to the hamcrest domain in order for me to publish from here. @tumbarumba 's account must have been linked to this in the past in order to stage and promote the last version.

[tumbarumba]

Yep, that's correct. My memory, I raised in issue in the Sonatype OSS Jira instance asking for publish permission to the group 'org.hamcrest'. Nat (an existing publisher in that group) approved that request.

It looks like the process has changed since then. @olibye, have a look at https://central.sonatype.org/publish/publish-guide/ and see if you can make any headway. I think I should be able to approve you if anyone asks

[tumbarumba]

OK, reading through that link, it looks more complicated. The old OSSRH is dead. We now have to register at https://central.sonatype.com. Oli, since you've been publishing JMock recently, I assume you've already done that.

Next, we need to register our account to a namespace. https://central.sonatype.org/register/namespace/ has details on how to do this. The gist of it is that we need to set a TXT record in DNS. I'm not sure who is managing the hamcrest.org domain. A dig query shows that the NS is managed through gandi.net.

@sf105 @npryce is this something either of you can help with?

[sf105]

I have access to the dns records.

[tumbarumba]

Hmmm... I just tried to add myself to 'org.hamcrest', but it failed because it's already registered (duh, Joe!). I think I need to email OSS support. @sf105, I'll send you an email separately.

[olibye]

According to this https://central.sonatype.org/register/legacy/#namespace-details-and-actions, the DNS stuff is for initial namespace registration which we've already done.

@sf105 are you able to contact sonatype as detailed above to add my lagacy usename olibye (that I already use for jMock)..
Thanks in advance

[sf105]

working on it. There's a bit of a problem in that it doesn't seem to recognise the account I believe I had set up. Not sure what to do to recover.