Broken Maven deployment dependencies - sbt-pgp and sbt-sonatype

[rococode]

I get these errors when including the algorithmia jar in my pom file:

[WARNING] The POM for org.xerial.sbt:sbt-sonatype:jar:1.1 is missing, no dependency information available [WARNING] The POM for com.jsuereth:sbt-pgp:jar:1.0.0 is missing, no dependency information available

This causes any maven build (compile/install/package etc) to fail when Algorithmia is included in the JAR, on machines with empty local .m2 repositories.

Upon further inspection, those two jars seem to be intended for deploying/publishing jar files to various repos. I don't think they're actually meant to be part of the library?

The main issue is that these libraries are unavailable on Maven's central repo. In fact xerial/sbt-pack#37 explicitly mentions that the library is not intended to support maven integration. So fresh Maven builds are unable to find the JAR and thus can't finish the build.

Currently I'm able to bypass this issue by manually excluding the two libraries:

                <exclusion>
                    <groupId>org.xerial.sbt</groupId>
                    <artifactId>sbt-sonatype</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.jsuereth</groupId>
                    <artifactId>sbt-pgp</artifactId>
                </exclusion>

This doesn't seem to break anything and disables the warning. Again, my assumption is these two libraries aren't actually used in the Algorithmia code itself, and are only used in the deploy process. Hence, when they are mistakenly included as actual dependencies, maven builds will crash after being unable to find them. But, manually excluding them doesn't cause any problems since the classes aren't actually used.

I'm not sure if anything is actually wrong here, maybe this is intended. But I would really appreciate a second look since the exclusion workaround is not ideal!