如何 GPG 签名并将 aar 直接发布到 Maven Central？

Question

I'm working on properly setting up my Gradle scripts for publishing an .aar directly to Maven Central (with JFrog sunsetting Bintray , numerous resources about publishing to Bintray are no longer relevant). One of the prerequisites is to have all artifacts (aar, sources jar, java-doc jar, pom.xml) uploaded alongside corresponding GPG-signature files (eg sources.jar.asc ).

Following these two guides (which are very much alike), I've largely managed to do so:

• https://medium.com/@nmauti/sign-and-publish-on-maven-central-a-project-with-the-new-maven-publish-gradle-plugin-22a72a4bfd4b
• https://www.albertgao.xyz/2018/01/18/how-to-publish-artifact-to-maven-central-via-gradle/

However, though well describing the solution using Gradle, both guides seem to focus on plain.jar's rather than.aar's. In particular, I wasn't sure about what to set up as a project archive in order to put on the automated sign+publish list, as suggested:

project.artifacts {
    archives sourceJar // Ok, I have a sourceJar task - will be signed and uploaded
    archives javadocJar // I use Dokka, but got that to work by registering my dokka task
    archives jar // What's "jar"? this doesn't help much!... :-/
}

I even tried registering the output .aar file, explicitly:

publications {
    android.libraryVariants.all { variant ->
        if (shouldPublishVariant(variant)) {
          // ...
          // ...

          variant.outputs.forEach { output ->
              project.artifacts {
                  archives output.outputFile // The full path of the .aar to publish!
              }
          }
        }
    }
}

But that seemed to have resulted in this flaky error:

Execution failed for task ':detox:publishMavenFullReleaseAarPublicationToMavenRepository'.
> Failed to publish publication 'mavenFullReleaseAar' to repository 'maven'
   > Invalid publication 'mavenFullReleaseAar': artifact file does not exist: '.../build/outputs/aar/library-full-release.aar.asc'

I'm looking for a stable, bullet-proof solution that would sort this out end-to-end, with no flaky errors.

Answer 1

As a solution, I've found that registering the task generating the .aar as a project archive -- rather than registering the file itself, does the trick (much like as done for the sources and javadoc jars):

publications {
    android.libraryVariants.all { variant ->
        if (shouldPublishVariant(variant)) {
          // ...
          // ...

          variant.outputs.forEach { output ->
              project.artifacts {
                  // For example: bundleProdReleaseAar is the task that generates library-prod-release.aar
                  archives project.tasks["bundle${variant.name.capitalize()}Aar"]
              }
          }
        }
    }
}