Publish Snapshot to oss.jfrog.org with multiple modules fails with 403

Question

I'm trying to publish a project with multiple modules to artifactory (oss.jfrog.org). When I run artifactoryPublish I get a 403 error but I know it's not a permissions issue because it works with a single module. It only fails trying publish multiple modules.

Some modules are aars and others are jars and all include sources. I can publish them all to Bintray, but can't publish to artifactory (for snapshots).

So the question is, how do I configure a multi-module project to publish snapshots to oss.jfrog.org.

I've figured out that if I change it to publish a single module and make the artifact name the same as the last part of the group, it works, but a different name doesn't work (gives 403 error).

So if group is com.example.foo I can publish foo.jar (com/example/foo/foo/1.0.0-SNAPSHOT/foo-1.0.0.jar). But I can't publish bar.jar (com/example/foo/bar/1.0.0-SNAPSHOT/bar.jar).

This gradle is included in every project's build.gradle

afterEvaluate {
    publishing {
        publications {
            mavenPublication(MavenPublication) {
                artifact sourcesJar
            if (project.plugins.hasPlugin("com.android.library")) {
                artifact("$buildDir/outputs/aar/${project.name}-debug.aar")
            } else {
                artifact("$buildDir/libs/${project.name}-${version}.jar")
            }
            groupId "com.example.foo"
            artifactId project.name // changing this to "foo" works for a single project
            version version
            pom {
                name.set(project.name)
                url.set(POM_URL)

                packaging POM_PACKAGING
                version version

                licenses {
                    license {
                        name.set(POM_LICENSE_NAME)
                        url.set(POM_LICENSE_URL)
                    }
                }

                developers {
                    developer {
                        name.set(POM_DEVELOPER)
                        }
                    }

                    scm {
                        url.set(POM_SCM_URL)
                        connection.set(POM_SCM_CONNECTION)
                        developerConnection.set(POM_SCM_DEV_CONNECTION)
                    }
                }
            }
        }
    }


    bintray {
        user = project.findProperty('bintrayUser') ?: System.getenv('BINTRAY_USER')
        key = project.findProperty('bintrayApiKey') ?: System.getenv('BINTRAY_API_KEY')
        configurations = ['archives']
        publish = true
        dryRun = true
        pkg {
            name = project.name
            repo = BINTRAY_REPO
            userOrg = BINTRAY_ORG
            licenses = [POM_LICENSE_NAME]
            vcsUrl = POM_SCM_URL
            version {
                name = project.name
                released = new Date()
            }
        }
    }

    artifactory {
        contextUrl = 'http://oss.jfrog.org'
        publish {
            repository {
                repoKey = 'oss-snapshot-local'
                username = project.findProperty('bintrayUser') ?: System.getenv('BINTRAY_USER')
                password = project.findProperty('bintrayApiKey') ?: System.getenv('BINTRAY_API_KEY')
            }
            defaults {
                publications('mavenPublication')
                publishArtifacts = true
                publishPom = true
            }
        }
        resolve {
            repoKey = 'jcenter'
        }
    }
}

Answer 1

Artifactory returns a 403 whenever you're trying to publish an artefact that already exists. In your case, if you've previously published snapshot artefacts from your multi module build, whenever you will try doing that again, you will get a 403. I know you can configure the user access to provide delete permissions to the account you are using to deploy, as indicated here. However, overwriting history is not considered a good practice.

Regarding renaming your groups and artefacts, I don't think that will provide a solution, as it's not your GAV coordinates that are the issue, but rather the fact that artefacts with matching GAV already exist.

If I may ask, why do you want to use SNAPSHOT artefacts? Can you not achieve the same behaviour with dynamic dependencies and dependency locking?