You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@plc4x.apache.org by cd...@apache.org on 2026/09/22 17:51:34 UTC
(plc4x-extras) branch rel/1.0 updated: chore: Hopefully now the release picks the right key to sign.
This is an automated email from the ASF dual-hosted git repository.
chrisdutz pushed a commit to branch rel/1.0
in repository https://gitbox.apache.org/repos/asf/plc4x-extras.git
The following commit(s) were added to refs/heads/rel/1.0 by this push:
new 547672ab chore: Hopefully now the release picks the right key to sign.
547672ab is described below
commit 547672abd4f6be049f84412729e452f6f98094c0
Author: Christofer Dutz <ch...@c-ware.de>
AuthorDate: Tue Sep 22 19:51:25 2026 +0200
chore: Hopefully now the release picks the right key to sign.
---
tools/release-2-prepare-release.sh | 20 ++++++++++++-----
tools/release-common.sh | 44 ++++++++++++++++++++++++++++++++++++++
tools/release-preflight.sh | 13 +++++------
3 files changed, 66 insertions(+), 11 deletions(-)
diff --git a/tools/release-2-prepare-release.sh b/tools/release-2-prepare-release.sh
index 7a72f8d0..f2ef045f 100755
--- a/tools/release-2-prepare-release.sh
+++ b/tools/release-2-prepare-release.sh
@@ -44,6 +44,16 @@ fi
require_apache_remote
echo "Apache remote: $APACHE_REMOTE ($APACHE_REMOTE_URL)"
+# The artifacts are signed in step 4 with this key, not with gpg's default one - see
+# "resolve_signing_key" in "release-common.sh". Looked up now rather than after the build.
+resolve_signing_key
+if [[ -z "$SIGNING_KEY" ]]; then
+ echo "❌ No gpg secret key found to sign the release with, aborting."
+ echo " Set 'gpg.keyname' in the 'apache-release' profile of your settings.xml."
+ exit 1
+fi
+echo "Signing key: $SIGNING_KEY ($SIGNING_KEY_SOURCE)"
+
# Maven 4 prefixes even quiet output with "[INFO] [stdout] ", so take the last token of the
# last line rather than the whole output.
PROJECT_VERSION=$("$DIRECTORY"/mvnw -f "$DIRECTORY"/pom.xml -q --non-recursive -Dexpression=project.version -DforceStdout help:evaluate | tail -n 1 | awk '{print $NF}')
@@ -158,7 +168,7 @@ SIGNED_ARTIFACTS=0
# carry on to the deployment below with unsigned artifacts.
while read -r line ; do
echo "Processing $line"
- if ! gpg -ab "$line"; then
+ if ! gpg --local-user "$SIGNING_KEY" -ab "$line"; then
echo "❌ Got non-0 exit code from signing artifact, aborting."
exit 1
fi
@@ -291,8 +301,8 @@ SIGNATURE_STATUS=$(gpg --homedir "$KEYS_GNUPGHOME" --batch --status-fd 1 \
# Field 3 of VALIDSIG is the key that made the signature, which is the signing subkey for anyone
# who signs with one. The last field is the fingerprint of the primary key, which is what carries
# the user ids, so prefer that and fall back to field 3 for older gpg output.
-SIGNING_KEY=$(echo "$SIGNATURE_STATUS" | awk '/^\[GNUPG:\] VALIDSIG /{print ($12 != "" ? $12 : $3); exit}')
-if [[ -z "$SIGNING_KEY" ]]; then
+SIGNATURE_KEY=$(echo "$SIGNATURE_STATUS" | awk '/^\[GNUPG:\] VALIDSIG /{print ($12 != "" ? $12 : $3); exit}')
+if [[ -z "$SIGNATURE_KEY" ]]; then
echo "❌ Could not work out which key signed the release, aborting."
rm -rf "$TEMP_DIR"
exit 1
@@ -300,14 +310,14 @@ fi
# Field 2 is the validity of the user id: skip the ones that are revoked ("r") or expired ("e"),
# so that an @apache.org address the key no longer stands behind does not satisfy the check.
-SIGNING_UIDS=$(gpg --homedir "$KEYS_GNUPGHOME" --batch --with-colons --list-keys "$SIGNING_KEY" 2>/dev/null \
+SIGNING_UIDS=$(gpg --homedir "$KEYS_GNUPGHOME" --batch --with-colons --list-keys "$SIGNATURE_KEY" 2>/dev/null \
| awk -F: '$1 == "uid" && $2 !~ /^[re]$/ {print $10}')
if echo "$SIGNING_UIDS" | grep -qiE '<[^>]+@apache\.org>'; then
echo "✅ The signing key is registered to an apache.org address"
else
echo "❌ The signing key is not registered to an apache.org address, aborting."
echo " Releases have to be signed with a key carrying your {apache-id}@apache.org address."
- echo " Key $SIGNING_KEY currently carries:"
+ echo " Key $SIGNATURE_KEY currently carries:"
echo "$SIGNING_UIDS" | sed 's|^| |'
rm -rf "$TEMP_DIR"
exit 1
diff --git a/tools/release-common.sh b/tools/release-common.sh
index eb63cae6..236c72b4 100644
--- a/tools/release-common.sh
+++ b/tools/release-common.sh
@@ -165,3 +165,47 @@ require_apache_remote() {
# Resolved once here so that every script that sources this file has APACHE_REMOTE available.
# Scripts that actually talk to the remote call "require_apache_remote" to insist on it.
resolve_apache_remote
+
+# ----------------------------------------------------------------------------------------------
+# Finding the signing key
+# ----------------------------------------------------------------------------------------------
+# The artifacts are signed by "release-2-prepare-release.sh" on the host, not by the
+# maven-gpg-plugin, but release managers configure their key the Maven way: as "gpg.keyname" in
+# the "apache-release" profile of their settings.xml. A plain "gpg -ab" ignores that and signs
+# with gpg's default key, which on a machine with more than one secret key is not necessarily the
+# Apache one. So the key is looked up here, and every script that signs or checks the signing
+# passes it to gpg explicitly - that way the preflight checks the very key the release signs with.
+
+# Filled in by "resolve_signing_key": the key, and where it was found.
+SIGNING_KEY=""
+SIGNING_KEY_SOURCE=""
+
+resolve_signing_key() {
+ SIGNING_KEY=""
+ SIGNING_KEY_SOURCE=""
+
+ # Letting Maven evaluate the property reads settings.xml the way a Maven build would - profile
+ # activation, "${env.*}" expressions and all - instead of picking the XML apart here. The
+ # value goes to a file because Maven 4 prefixes even quiet output with "[INFO] [stdout]".
+ local output keyname
+ output=$(mktemp)
+ if "$DIRECTORY/mvnw" -q -f "$DIRECTORY/tools/stage.pom" -Papache-release \
+ help:evaluate -Dexpression=gpg.keyname -Doutput="$output" > /dev/null 2>&1; then
+ keyname=$(head -n 1 "$output" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+ # That is what help:evaluate writes for a property that is not set.
+ if [[ -n "$keyname" && "$keyname" != "null object or invalid expression" ]]; then
+ SIGNING_KEY="$keyname"
+ SIGNING_KEY_SOURCE="'gpg.keyname' of the 'apache-release' profile in settings.xml"
+ fi
+ fi
+ rm -f "$output"
+
+ # Without a configured key, settle on the first secret key that can sign - and name it, so it
+ # is at least the same key everywhere rather than whatever gpg picks on its own.
+ if [[ -z "$SIGNING_KEY" ]]; then
+ SIGNING_KEY=$(gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '$1 == "sec" && $12 ~ /S/ {print $5; exit}')
+ if [[ -n "$SIGNING_KEY" ]]; then
+ SIGNING_KEY_SOURCE="the first secret key in the gpg keyring, as 'gpg.keyname' is not set"
+ fi
+ fi
+}
diff --git a/tools/release-preflight.sh b/tools/release-preflight.sh
index 82668c14..690e19af 100755
--- a/tools/release-preflight.sh
+++ b/tools/release-preflight.sh
@@ -213,16 +213,17 @@ fi
echo
echo "── Signing ───────────────────────────────────────────────────────────────────"
-# The release is signed with whatever key git is configured to use, or the default secret key.
-SIGNING_KEY=$(git -C "$DIRECTORY" config user.signingkey)
-if [[ -z "$SIGNING_KEY" ]]; then
- SIGNING_KEY=$(gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '/^sec:/ {print $5; exit}')
-fi
+# The same lookup the release itself does, see "resolve_signing_key" in "release-common.sh" - so
+# everything below checks the key the artifacts will actually be signed with.
+resolve_signing_key
if [[ -z "$SIGNING_KEY" ]]; then
fail "No gpg secret key found, a release has to be signed."
else
- ok "Signing with key '$SIGNING_KEY'"
+ ok "Signing with key '$SIGNING_KEY' ($SIGNING_KEY_SOURCE)"
+ if [[ "$SIGNING_KEY_SOURCE" != *settings.xml* ]]; then
+ warn "Set 'gpg.keyname' in the 'apache-release' profile of your settings.xml, rather than relying on the first secret key."
+ fi
# An Apache release has to be signed with a key that carries the release manager's
# "{apache-id}@apache.org" address, so check that before the signing takes an hour to fail.