Cosider publishing Android toolchain somewhere

In order to create a development build for Android, one needs to build tor-browser-build. That is the case, because there are some build tools and artifacts required for development builds that come from tor-browser-build -- namely tor-expert-bundle and noscript, but I have also just made application-services a requirement.

I would be really nice if instead one could just fetch these tools and artifacts from somewhere. https://nightlies.tbb.torproject.org/ is the first place that comes to my mind, but I am not sure that is the best place for this actually, so I think part of this ticket should be think and figure out what is the best place to do it -- if we decide to do it.

It seems like a very intense step to have to build tor-browser-build just for working on Android, since this is a far from trivial project and also takes a really long time to do so.

I would be really nice if instead one could just fetch these tools and artifacts from somewhere. https://nightlies.tbb.torproject.org/ is the first place that comes to my mind, but I am not sure that is the best place for this actually, so I think part of this ticket should be think and figure out what is the best place to do it -- if we decide to do it.

Adding application-services to the build outputs for nightly, along with the other build files on https://nightlies.tbb.torproject.org/ seems fine and the easiest to make it available.

Oh I totally missed this comment Yes! I agree this is the easiest way to go about it. As @micah commented below though, we could go fancier and publish to a Maven repository. I think the advantage of that would be to seamlessly plug into the Android build environment.

mentioned in issue #41010

Isn't this what Maven Central is specifically for?

GuardianProject has long expressed a desire for things like geoip files that we produce to be published to Maven Central. Its the standard place for Android and Java libraries, and accepts arbitrary packages as well. It also fully supports reproducible builds with a .buildinfo file. It is also the standard way that android folks use to provide and consume these things. We have a Sonatype/OSSRH/Maven central account that can be used for this type of thing.

It is also possible, and indeed desirable, to publish a maven repository here in our gitlab, for example this is being done here:

https://gitlab.torproject.org/tpo/network-health/metrics/geoip-data/-/packages/788

Yes, but I am not sure if we can use Maven Central specifically. I think we'd need to have our own Maven repository that we publish things to. cc @pierov has thought about this specific option for longer.

Can you say more about why you don't think we can use Maven Central?

Regardless of that, we do have our own maven repository capability here in gitlab, which can be produced in CI, which is what is happening here: https://gitlab.torproject.org/tpo/network-health/metrics/geoip-data/-/packages/788

Sorry, I completely ignored the second part of your message when you talked about our Maven repo. Cool!

About why we could not use Maven Central. I am not sure, but at least for application-services it's packages are already in Maven Central -- the official version (https://mvnrepository.com/artifact/org.mozilla.appservices). And for tor-browser we are using a modified version of it. Maybe that is easy to overcome if we just slightly modify the package name, but

marked this issue as related to #41418