Validate pom + components properties

[martinbonnin]

This is a follow up from @IgnatBeresnev excellent talk at KotlinConf. We could enforce that properties have meaningfull values. One example I have in mind is using a SPDX license id for license name.

We could also validate the components (make sure everything has sources, signatures, extensions, etc...)

• SPDX license identifiers
• valid groupId
• valid artifactId
• Sonatype requirements
• all files must have an extension
• snapshots must end with -SNAPSHOT
• releases must not end with -SNAPSHOT
• GPG keys have been uploaded to a central server (from https://central.sonatype.org/publish/requirements/gpg/#distributing-your-public-key)

[LouisCAD]

Could also check the GPG keys match the email address declared in the POM

[martinbonnin]

the email address declared in the POM

@LouisCAD developer.email is not required by Maven Central. More generally, how big of a problem is it to have different email adresses? I can see how some orgs might want different email adresses for their signing key (security@) vs their project contact (hello@).

[LouisCAD]

Right. I assumed there was a match requirement. Good if there's none!