How to publish ManifoldCF artifacts to Maven central repository

[Karl Wright <da...@gmail.com>]

In response to various questions we've had lately over how to get
ManifoldCF framework jars into Maven, it appears that maven artifacts get
svn pubsub'd just like normal release artifacts.  Here's the svn url:

https://repository.apache.org/content/repositories/releases/

All we would need, then, is an "org/apache/manifoldcf" area we have
permission to write to, as well as an understanding of what we would need
to commit on every release.

Poking around, the project hierarchy structure is typically:

<project>/<subproject>/<version>

At the <project>/<subproject> level, there's a maven-metadata.xml file,
along with .md5 and.sha1 files.  The xml file has this form:

<metadata><groupId>org.apache.chemistry.opencmis</groupId><artifactId>chemistry-opencmis-dist</artifactId><versioning><latest>0.12.0</latest><release>0.12.0</release><versions><version>0.1.0-incubating</version><version>0.2.0-incubating</version><version>0.3.0</version><version>0.4.0</version><version>0.5.0</version><version>0.6.0</version><version>0.7.0</version><version>0.8.0</version><version>0.9.0-beta-1</version><version>0.9.0</version><version>0.10.0</version><version>0.11.0</version><version>0.12.0</version></versions><lastUpdated>20140822044512</lastUpdated></versioning></metadata>

The md5 has this form:

b171fc01e562b7445465a1cb9acb4146

The sha1 has this form:

1fefae260d345af1a6f5ad6ad2a058d468fe9e10

Each artifact in each <version> directory includes the version number in
its name, in standard form.  Md5 and sha1 signature files are also required
for each artifact, in the same form as above.  Finally, there's a pom file
for each version, e.g.:

chemistry-opencmis-dist-0.9.0.pom
<http://repository.apache.org/content/repositories/releases/org/apache/chemistry/opencmis/chemistry-opencmis-dist/0.9.0/chemistry-opencmis-dist-0.9.0.pom>

In the Chemistry case, the distribution artifacts look much like ours, e.g.
a lib, bin, and src distribution, but they are clearly assembled by Maven,
which also produces the above "distribution pom".  The pom file has an
associated pom.asc file, which is a signature file of the following form:

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAABAgAGBQJRozyZAAoJEDVzuk5v5XAeWXsP/jkT6KfMx0g7vLrkQH+EF7Lt
22rFZSJL2it75kEnl19CKutDsp+NzpaF5EgUnIBhizpmnfQohOt7fcFvLKGysl4B
xZKab9ZI9FfcORP5ktrb76+Dsu/n1Mx+g9BU5Z5au1oLDML7hupbfNVRwACnM0S9
f6qu42vIvoueJVXa526dNSWE6rzsqmmSNbwwZ53xLYD+vuhZQkol/d5QBmt1BpPR
wkfUFOTgtIOU3vxdhm2QQ+9LgdN310HkfR7QXKUW/X+PngZOwRDaLWR3ZTHkSZke
fGrrmSp1k3+on7kLwagmrXuyjtH+PqHfqYTkjE8M8NKAXuh/m9v5ozk2lkoxChgQ
Mu0xSD8xcovfPurAsbMvqkuLhNOObuwG0ZiiEPEsSsHbWDWkCKvUTDAlhmlSA9zx
Xp6c6EXn8tjKWRQwWxMFss+3HMBVVFPs1hJIFfBPG7ysWZrwoetqeMhs2A/NN/Te
U1mGVKkMedS3kR97gqWxXdDWIi7Ml2wBPBz0IygM4z/jPRfmxr9CXxBa3Eg5u7jM
O8DAayjmx3CYVkLegMzaxIuZeKCz4vGaBUWajKdtURX/Fn16u+PylbMfC8NBcQXt
VmdDBH6s4T7CXx25KCf+KGrhBpgj1OVmMEmiOGLlYmEIUdr2vy0BLDM4Qk+dr/3i
Ax8OxMwedsr9GfLXyP6S
=C3ov
-----END PGP SIGNATURE-----

The pom.asc has a corresponding md5 and sha1 signature as well.

Karl