This actually makes the world a better place. Every serious Java project is capable of meeting Maven Central‘s few requirements and publish artifacts there. Bintray is just a place to put stuff on the internet. Which serious project would use artifacts from such a place?
Publishing to maven central isn't particularly difficult, but it is a high friction process.
You have to file an issue on a JIRA board.
Provide proof of owning a namespace(dns txt record, or github).
Wait for a human to review and approve the ticket.
Create a PGP key.
Publish the PGP key to public key servers.
Submit your builds via the webapp.
Wait for the verification process to complete.
Have it fail a bunch of times randomly, because despite uploading your PGP key to as many of the keyservers as you could, there seems to be a huge key replication delay between keyserver instances, and the verification process can't find the key published.
Once verified, actually publish the build.
Most of the pain is one off, once you have gone though it, publishing new builds can be automated.
The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published.
10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.
> The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.
Seconded - the process is fine if you're an Apache project or whatever, but for an individual developer with a handful of small libraries to share, it's not worth it.
The process is also not difficult for individual developers. Most of the steps to publish on Maven Central have to be done only once and there is good documentation about how to do it. Meeting some minimum requirements, such as proving namespace ownership or defining a license, improves the quality of a public artifact repository significantly. Who wants to use artifacts from a repository where everyone can just dump their stuff whithout any checks? Or who wants to use software that is based on such dependencies? Although Maven Central is not a perfect place either, you can at least be sure that the artifacts there meet some basic requirements.
> Which serious project would use artifacts from such a place?
Plenty of them, since it's just adding a few lines to either pom.xml or the Gradle script. Sure, maybe there's rules against it in your org, but if it works then a code reviewer might say whatever, there's bigger problems
