Releases

Clojars offers two repositories, Classic (http://clojars.org/repo/) and Releases (http://releases.clojars.org/repo/). Inclusion in the Classic repository has practically no restrictions—anyone may sign up for an account and publish their project's artifacts to it on a first-come-first-serve basis. Releases is intended to be a middle ground in between the anything-goes nature of the Classic repository and the bureaucracy of the Maven Central repository.

Releases enforces a few restrictions:

• Snapshot versions are not allowed. Adding repositories containing snapshots can have adverse affects upon dependency resolution time and can introduce unexpected results in the context of version ranges. If you need snapshots, you can add the Classic repository explicitly, but it should not be included by default.

• Projects must declare a description, license, and URL in their pom.xml or project.clj file.

• All files must be signed by a PGP key listed as being owned by someone who has access to the project's group.

If you publish to Clojars using Leiningen 2, it will warn you when you haven't declared the necessary metadata and will also attempt to sign files as they are being deployed.

Promotion

There is no way to deploy directly to the releases repository; artifacts are promoted from the Classic repository. Once you've deployed to Classic using lein deploy clojars or another method, you can visit the project's page in a browser; for example the Slamhound project is at https://clojars.org/slamhound.

If you are logged in, you should see a "promotion" section. If the project is qualified for promotion, a Promote button will be visible. If not, it will show a list of reasons why it's not qualified.

Signing and keys

If you have a PGP key pair already, visit the profile page and include it in your profile so that the files you sign can be checked against it.

For details on setting up GPG and generating keys, see the Leinigen GPG documentation or invoke lein help gpg using lein 2.1.0 or newer.

Once you have a key, you can show it with gpg --export -a $KEY_ID. Replace $KEY_ID with your actual key id, copy the output of that command (including the -----BEGIN PGP PUBLIC KEY BLOCK----- parts), and paste it into your Clojars profile.