GitHub has apparently deleted that topic, which is a shame. Here is a web-archive https://web.archive.org/web/20210121141140/https://github.community/t/download-from-github-package-registry-without-authentication/14407

It is 3 4 years now - is there any timespan / updates / plan or ETA?

We want to use this to publish an open source library/fork that can be consumed from everyone without a token. So having any kind of auth only makes sense for private packages. I mean container registry public is also without auth

That literally defeats the role of a maven repository.
The dev who made the code already has the packages installed on his own machine, since "mvn install" does exactly that.

New plan: not gonna happen.
https://github.com/orgs/community/discussions/26634#discussioncomment-8527086

@clarkbw I don't think that's a good idea. If you give people a PAT they would be able to write to the registry also wouldn't they?

It is very strange. Github keeps improving in many excellent ways, but the package repository seems to get no attention whatsoever. It's still plagued by poor performance and stability too.

Jitpack is unfortunately very unreliable

Unreliable how?

Please never use Jitpack. It's an unmaintained and broken mess. Even as the author you can't opt out or delete old builds jitpack created without permission or asking.

If you are working on an open source project that needs to distribute Maven libraries in a developer-friendly way, isn't Jitpack one of the very few (if not only) options?

Anyway, we have been using Jitpack for a while, and it works well for our purpose (distributing Android .aar libraries to other open source Android apps. It integrates well with the GitHub release system.

Example here: https://jitpack.io/#elimu-ai/content-provider

Let's not derail the conversation too much from GitHub packages. It currently does not fit our usage and hosting model. I'm still requesting some info on why the GitHub packages require credentials still, and how hard it would be to potentially fix it? Is it really complex for some reason I can't think of?

Anyway - this is what I want for Christmas, GitHub.

Now you can kill your project:
https://github.com/orgs/community/discussions/26634#discussioncomment-9870811

Yes, that's a problem of your answer.

I don't need to propose something better to explain why it is bad.
More precisely, whether or not I can propose something better does not make your proposal a better one.

Learn humility rather than arrogance.

Yes, that's a problem of your answer.

I don't need to propose something better to explain why it is bad. More precisely, whether or not I can propose something better does not make your proposal a better one.

Learn humility rather than arrogance.

My proposal works well for me and anyone else who builds my app. This is all I need.

Yes, that's a problem of your answer.

I don't need to propose something better to explain why it is bad. More precisely, whether or not I can propose something better does not make your proposal a better one.

Learn humility rather than arrogance.

As I promised there is a final solution: make a GitHub repo to act as a Maven repo. No sensitive info in scripts!

This working script to publish artifacts into separate repo:

name: Java CI

on: 
  workflow_dispatch:

permissions:                    # Global permissions configuration starts here
  contents: write
  pull-requests: write

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - name: Checkout this repo
      uses: actions/checkout@v4

    - name: Set up JDK 1.8
      uses: actions/setup-java@v4
      with:
        distribution: 'adopt'
        java-version: '8'
    
    - name: Extract latest commit message and hash
      run: |
        GIT_MESSAGE=$(git log -1 --pretty=format:"%s")
        GIT_HASH=$(git log --pretty=format:'%h' -n 1)
        echo "GIT_MESSAGE=$GIT_MESSAGE" >> $GITHUB_ENV
        echo "GIT_HASH=$GIT_HASH" >> $GITHUB_ENV

    - name: Install xmlstarlet
      run: sudo apt-get install -y xmlstarlet

    - name: Build with Gradle
      run: |
        bash ./gradlew build
        bash ./gradlew publishToMavenLocal

    - name: Extract artifactId, groupId, version from generated POM file
      id: extract_version
      run: |
        xml_file=$(find ~/.m2/repository -type f -name "*.pom" -print -quit)
        VERSION=$(xmlstarlet sel -N xmlns="http://maven.apache.org/POM/4.0.0" -t -v "//xmlns:project/xmlns:version" "$xml_file")
        GROUPID=$(xmlstarlet sel -N xmlns="http://maven.apache.org/POM/4.0.0" -t -v "//xmlns:project/xmlns:groupId" "$xml_file" | sed 's/\./\//g')
        ARTIFACTID=$(xmlstarlet sel -N xmlns="http://maven.apache.org/POM/4.0.0" -t -v "//xmlns:project/xmlns:artifactId" "$xml_file")       
        echo "VERSION=$VERSION" >> $GITHUB_ENV
        echo "GROUPID=$GROUPID" >> $GITHUB_ENV
        echo "ARTIFACTID=$ARTIFACTID" >> $GITHUB_ENV

    - name: Checkout artifact repo
      uses: actions/checkout@v4
      with:
        repository: 'RiV-chain/artifact'
        ref: ${{ github.head_ref }}
        fetch-depth: 0
        token: ${{ secrets.MAVEN_PAT }}

    - name: Create package directories
      run: |
        mkdir -p ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}

    - name: Copy JAR, POM, SHA-1, and MD5 files
      run: |
        FIRST_TERM=$(echo "${{ env.GROUPID }}" | cut -d'/' -f1)
        cp -r ~/.m2/repository/$FIRST_TERM .
        mv ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/maven-metadata-local.xml ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/maven-metadata.xml
        sha1sum ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.jar > ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.jar.sha1
        md5sum ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.jar > ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.jar.md5
        sha1sum ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.pom > ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.pom.sha1
        md5sum ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.pom > ${{ env.GROUPID }}/${{ env.ARTIFACTID }}/${{ env.VERSION }}/${{ env.ARTIFACTID }}-${{ env.VERSION }}.pom.md5

    - name: Commit and push files
      run: |
        git config user.name "${{ github.actor }}"
        git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
        git add .
        git commit -m "${{ env.GIT_MESSAGE }} https://github.com/${{ github.event.repository.full_name }}/commit/${{ env.GIT_HASH }}. Version: ${{ env.VERSION }}"

    - name: Push changes
      uses: ad-m/github-push-action@master
      with:
        github_token: ${{ secrets.MAVEN_PAT }}
        repository: RiV-chain/artifact
        force_with_lease: true

https://github.com/RiV-chain/rlp/blob/master/.github/workflows/gradle.yml

This is result in target repo acting as a Maven repo:
https://github.com/RiV-chain/artifact

And this really works? It seems like a overcomplicated system to setup. Especially if in such a case you could just use jitpack for more or less the same result with much less work.

Also, a little tip: Maybe don't publicly share your e-mail used in your example, to avoid copy-pasters from using it without thinking first. Just a thought.

And this really works? It seems like a overcomplicated system to setup. Especially if in such a case you could just use jitpack for more or less the same result with much less work.

Also, a little tip: Maybe don't publicly share your e-mail used in your example, to avoid copy-pasters from using it without thinking first. Just a thought.

Yes, it works. I have already correct email hard coded issue and added auto comments with latest commit hash link. Here is much more advanced setup but in other hand there is totally most flexible way:

• Comments for each artifact release with links to latest commit hash
• Git branches give you set of repos such as main, develop, stg and whatever you desire
• The repo or a particular artifact can be rolled back to any previous state
• Can be converted to a GitHub Action
• Everyone may create a fork for the repo and publish new artifacts with convenient GitHub approval workflow

I think this is not the end of the list of advantages over jitpack.

Guess they hate having customers

While yes this is a nice hack in gradle, sadly it doesn't solve the underlying issue of GitHub not allowing unauthorized downloads.

Asking every "customer" of your lib to add this hack to their gradle scripts is not a good selling point. They would need that for every GitHub lib. Adding 3 lines of bizzare code is not user friendly

While yes this is a nice hack in gradle, sadly it doesn't solve the underlying issue of GitHub not allowing unauthorized downloads.

Asking every "customer" of your lib to add this hack to their gradle scripts is not a good selling point. They would need that for every GitHub lib. Adding 3 lines of bizzare code is not user friendly

I will check this out https://docs.github.com/en/contributing/writing-for-github-docs/configuring-redirects which would redirect to a project artifacts with pom.xml and related jars removing middle group ID from URLs.

See: https://github.com/orgs/community/discussions/26634#discussioncomment-9864757

This is exactly what my answer solved. There is no need to generate PAT to download files from repos. It's necessary only for a publisher that is obviously acceptable. See my example above:
https://github.com/orgs/community/discussions/26634#discussioncomment-9870811

nice solution i can use this for my passion projects but i'm blaming whoever made this decision that this should be a problem in first place

it could've been understandable if it's at least consistent. registries for maven, nuget, npm rubygens etc. require authentication to download but containers registry allow anonymous access: docker pull ghcr.io/..

https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#about-setting-visibility-and-access-permissions-for-packages

fun fact: azure devops allows anonymous / public access https://learn.microsoft.com/azure/devops/artifacts/get-started-maven?view=azure-devops

You can consider this GitHub Action to publish your artifact and repurpose your GH repo to store maven artifacts having all advantages of git or use this GitHub Action to copy your local file to remote repo as a Maven artifact (md5/sha254 hash files and metadata files create automatically) with a corresponding commit message