Skip to content

Add Maven Central (Sonatype) publishing support for Android#4689

Open
0xh3rman wants to merge 2 commits intotrustwallet:masterfrom
0xh3rman:mvn-central-publish
Open

Add Maven Central (Sonatype) publishing support for Android#4689
0xh3rman wants to merge 2 commits intotrustwallet:masterfrom
0xh3rman:mvn-central-publish

Conversation

@0xh3rman
Copy link
Contributor

@0xh3rman 0xh3rman commented Mar 2, 2026

Summary

Add Sonatype (Maven Central) as a publish target for Android artifacts, inspired by #4641

Closes #4612 (Javadoc for Android artifacts)
Closes #4613 (POM metadata)
Closes #4614 (Artifact signing)

Why we need this

  1. GitHub Packages (GPR) requires a GitHub token to download — not ideal for public libraries
  2. F-Droid and WalletScrutiny do not recommend GPR for reproducible builds
  3. Maven Central packages are publicly downloadable without authentication and widely adopted

Changes

  • Add gradle-nexus-publish-plugin to android/build.gradle with Sonatype Central config
  • Add POM metadata and conditional PGP signing to wallet-core and wallet-core-proto
  • Add Javadoc JARs to wallet-core and wallet-core-proto (required by Maven Central)
  • Add --target flag to tools/android-release for testing individual targets (local, sonatype,
    gpr, all)

Usage

# Publish to Maven Central (staging only, release manually):
tools/android-release 4.1.0 --target sonatype

# Publish to all targets:
tools/android-release 4.1.0

Setup

Before publishing to Sonatype:

  1. Verify com.trustwallet namespace is claimed in Central Portal Namespaces
  2. Set environment variables:
    - SONATYPE_USERNAME / SONATYPE_PASSWORDGenerate a token
    - MVN_SIGNING_KEY / MVN_SIGNING_PASSPHRASESet up GPG signing

Notes

Sonatype publishing could not be fully tested locally (requires credentials), but follows the same
pattern used to publish Gemstone to Maven Central: https://central.sonatype.com/artifact/com.gemwallet.gemstone/gemstone, there is no public release workflows in wallet core, so we only updated the script

Test

tools/android-release 0.0.1-test --target local # verify Gradle config compiles and artifacts appear
in ~/.m2

@sergei-boiko-trustwallet @10gic @alex-kobozev-tw could you guys take a look?

Thanks

@0xh3rman 0xh3rman requested a review from a team as a code owner March 2, 2026 01:31
@0xh3rman
Copy link
Contributor Author

0xh3rman commented Mar 6, 2026

@sergei-boiko-trustwallet could you please take a look and approve CI? thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant