how does njord:validate actually validate

[hgschmie]

I have a bundle that I could upload to Sonatype Central but fails validation locally (with njord:validate). I was wondering whether njord actually validates locally or does it do some API call to the publisher (if they offer an API) to validate the information?

If the former, can the rules be tweaked (ideally on a per-project basis)?

[cstamas]

Is not API as Sonatype does not expose any. Validation happens locally, by code tgat was implemented while reading Central requirements. Hence, for sure there are subtle and probably less subtle differences between the two.

Ideally, Sonatype would provide me spec how they validate, or alike... This is why validation is not always invoked on publish.

[hgschmie]

can I control what gets validated? E.g. if I want to loosen up those restrictions, can I configure that for the njord plugin?

[kwin]

Validation is currently bound to the publisher with no way to overwrite (

njord/publisher/sonatype-cp/src/main/java/eu/maveniverse/maven/njord/publisher/sonatype/cp/SonatypeCentralPortalPublisherFactory.java

Line 61 in 5850491

centralRequirementsFactory.create(session),

). However validation is optional and only executed if manually invoked via njord:validate.

[cstamas]

Yup, so the idea is that the rules are defined by the service where you publish to, and it is not the publisher (you) who defines them.

[alitheg]

Ideally, Sonatype would provide me spec how they validate, or alike... This is why validation is not always invoked on publish.

@cstamas Is this the spec you need? https://central.sonatype.org/publish/requirements

I'm working on auto-publishing for the Apache Tooling team using njord to stage, validate and publish, and I noticed njord doesn't seem to flag missing POM information that Maven Central does (project name, description, url, license/developer information, scm - see https://central.sonatype.org/publish/requirements/#required-pom-metadata)