Why do I need to verify project ownership?⚓︎
Why do I need to verify project ownership?
How do I verify I own my project?
We require some basic verification steps for your requested group ID to help protect both publishers and consumers of the Central Repository. For instance, no one wants to use fake components published by someone that's impersonating an organization such as org.apache or com.google. You also wouldn't want to have your own namespace squatted on by someone who does not control your DNS domain or SCM hosted project (such as Github).
We understand that verifying your project may require a few extra steps on your part, but we try to keep our verification requirements as simple as possible, and try to follow industry best practices with what we ask for.
If you own your own domain and want to register a group ID for it, we will ask that you create a DNS TXT record for your domain that contains the JIRA ticket number for your new project request.
As an example, let's say you own the domain myjavawidget.io, and you want to register the group ID io.myjavawidget. First, open a new project request and record your ticket number which should look something like OSSRH-00000. You would then need to configure a DNS TXT record with your DNS hosting provider that contains the text "OSSRH-00000" which will allow either our automation or support staff to verify that you control the domain. Using DNS TXT records for verification is very common with other service providers (such as Google), and you can also delete the TXT record after we have completed verification and setup your project.
If you are registering a group ID based on your SCM host (such as Github, Bitbucket, Gitee, etc), we will ask that you create a publicly accessible repository that is named after your JIRA ticket number (such as OSSRH-00000 in the example above). This will help us verify that you control your source code repository. This repository can also be deleted after we have verified and setup your project.