You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@toree.apache.org by lr...@apache.org on 2026/09/11 16:13:28 UTC
(incubator-toree) branch master updated: Pass the GPG passphrase through the environment (#275)
This is an automated email from the ASF dual-hosted git repository.
lresende pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-toree.git
The following commit(s) were added to refs/heads/master by this push:
new 51a21381 Pass the GPG passphrase through the environment (#275)
51a21381 is described below
commit 51a213812b61ef4bfe9350acb1594c06413ecf73
Author: Luciano Resende <lr...@apple.com>
AuthorDate: Fri Sep 11 09:13:23 2026 -0700
Pass the GPG passphrase through the environment (#275)
The -Dpassphrase never reached maven-gpg-plugin: the parameter's expression
is ${gpg.passphrase}, and it has no alias, so the system property named
"passphrase" was silently ignored and signing fell back to gpg-agent.
The plugin also deprecates that parameter outright -- "Do not use this
configuration, it may leak sensitive information" -- because anything on
argv is readable by any local user via ps.
Take the passphrase from MAVEN_GPG_PASSPHRASE, the default of the
plugin's passphraseEnvName and the route it documents for batch-mode
signing, and export it once rather than aliasing GPG_PASSPHRASE at each
call site. This renames the script's own input variable, so a release
environment exporting GPG_PASSPHRASE will now be prompted instead.
Pin the plugin version while here: an unversioned prefix resolves to
whatever is latest at release time, and passphraseEnvName only exists
from 3.2.0 onward.
---
etc/tools/release-build.sh | 41 ++++++++++++++++++++++++++++++++++-------
1 file changed, 34 insertions(+), 7 deletions(-)
diff --git a/etc/tools/release-build.sh b/etc/tools/release-build.sh
index 7571141c..d38f1181 100755
--- a/etc/tools/release-build.sh
+++ b/etc/tools/release-build.sh
@@ -50,7 +50,7 @@ OPTIONS
A GPG passphrase is expected as an environment variable
-GPG_PASSPHRASE - Passphrase for GPG key used to sign release
+MAVEN_GPG_PASSPHRASE - Passphrase for GPG key used to sign release
EXAMPLES
@@ -136,12 +136,21 @@ while [ "${1+defined}" ]; do
done
-if [[ -z "$GPG_PASSPHRASE" ]]; then
- echo 'The environment variable GPG_PASSPHRASE is not set. Enter the passphrase to'
+# Pinned so the release is reproducible and so passphraseEnvName (3.2.0+) is available.
+MVN_GPG_PLUGIN="org.apache.maven.plugins:maven-gpg-plugin:3.2.8"
+
+if [[ -z "$MAVEN_GPG_PASSPHRASE" ]]; then
+ echo 'The environment variable MAVEN_GPG_PASSPHRASE is not set. Enter the passphrase to'
echo 'unlock the GPG signing key that will be used to sign the release!'
echo
- stty -echo && printf "GPG passphrase: " && read GPG_PASSPHRASE && printf '\n' && stty echo
- fi
+ stty -echo && printf "GPG passphrase: " && read MAVEN_GPG_PASSPHRASE && printf '\n' && stty echo
+fi
+# maven-gpg-plugin reads the passphrase from this variable, so it must be exported
+# for the deploy commands below; a value inherited from the caller already is.
+# MAVEN_GPG_PASSPHRASE is the plugin's default passphraseEnvName, so no extra
+# configuration is needed to point it here. See:
+# https://github.com/apache/maven-gpg-plugin/blob/76316ce61699afaec7a298fd279e1c9133c38ac6/src/main/java/org/apache/maven/plugins/gpg/AbstractGpgMojo.java#L45
+export MAVEN_GPG_PASSPHRASE
if [[ "$RELEASE_PREPARE" == "true" && -z "$RELEASE_VERSION" ]]; then
echo "ERROR: --releaseVersion must be passed as an argument to run this script"
@@ -295,7 +304,16 @@ if [[ "$RELEASE_PREPARE" == "true" ]]; then
svn ci -m"Apache Toree $RELEASE_STAGING_FOLDER"
cd "$BASE_DIR/target"
- mvn gpg:sign-and-deploy-file -DgroupId=org.apache.toree -DartifactId=toree-assembly -Dversion=$RELEASE_VERSION-incubating -Dpackaging=jar -Dfile=toree/dist/toree/lib/toree-assembly-$RELEASE_VERSION-incubating.jar -DrepositoryId=apache.releases.https -Durl=https://repository.apache.org/service/local/staging/deploy/maven2 -Dpassphrase=$GPG_PASSPHRASE
+ # The passphrase reaches the plugin through MAVEN_GPG_PASSPHRASE rather than the
+ # command line, where it would be visible to any local user through ps.
+ mvn "$MVN_GPG_PLUGIN:sign-and-deploy-file" \
+ -DgroupId=org.apache.toree \
+ -DartifactId=toree-assembly \
+ -Dversion="$RELEASE_VERSION-incubating" \
+ -Dpackaging=jar \
+ -Dfile="toree/dist/toree/lib/toree-assembly-$RELEASE_VERSION-incubating.jar" \
+ -DrepositoryId=apache.releases.https \
+ -Durl=https://repository.apache.org/service/local/staging/deploy/maven2
fi
cd "$BASE_DIR" #exit target
@@ -314,7 +332,16 @@ if [[ "$RELEASE_PUBLISH" == "true" ]]; then
make clean dist release
cd "$BASE_DIR/target"
- mvn gpg:sign-and-deploy-file -DgroupId=org.apache.toree -DartifactId=toree-assembly -Dversion=$RELEASE_VERSION-incubating -Dpackaging=jar -Dfile=toree/dist/toree/lib/toree-assembly-$RELEASE_VERSION-incubating.jar -DrepositoryId=apache.releases.https -Durl=https://repository.apache.org/service/local/staging/deploy/maven2 -Dpassphrase=$GPG_PASSPHRASE
+ # The passphrase reaches the plugin through MAVEN_GPG_PASSPHRASE rather than the
+ # command line, where it would be visible to any local user through ps.
+ mvn "$MVN_GPG_PLUGIN:sign-and-deploy-file" \
+ -DgroupId=org.apache.toree \
+ -DartifactId=toree-assembly \
+ -Dversion="$RELEASE_VERSION-incubating" \
+ -Dpackaging=jar \
+ -Dfile="toree/dist/toree/lib/toree-assembly-$RELEASE_VERSION-incubating.jar" \
+ -DrepositoryId=apache.releases.https \
+ -Durl=https://repository.apache.org/service/local/staging/deploy/maven2
cd "$BASE_DIR" #exit target