[PR] Pass the GPG passphrase through the environment [incubator-toree]

["lresende (via GitHub)" <gi...@apache.org>]

lresende opened a new pull request, #275:
URL: https://github.com/apache/incubator-toree/pull/275

   The release script passed the signing passphrase as
   `-Dpassphrase=$GPG_PASSPHRASE`, which maven-gpg-plugin never read. The
   parameter's expression is `${gpg.passphrase}` and it has no alias, so
   the system property named `passphrase` was silently ignored and signing
   fell back to prompting gpg-agent. The plugin deprecates that parameter
   outright -- "Do not use this configuration, it may leak sensitive
   information" -- since anything on argv is readable by any local user
   through ps.
   
   - Pass the passphrase via MAVEN_GPG_PASSPHRASE, the default of the
     plugin's passphraseEnvName, documented as the recommended route for
     batch-mode signing
   - Pin maven-gpg-plugin to 3.2.8: an unversioned goal prefix resolves to
     whatever is latest at release time, and passphraseEnvName only exists
     from 3.2.0 onward
   - Quote the file arguments while touching these lines
   
   Verified against a throwaway keyring with the agent cache disabled and
   the agent killed between runs:
   
   | passphrase supplied as | result |
   | --- | --- |
   | nothing (control) | fails, `gpg: signing failed: No pinentry` |
   | `-Dpassphrase` | fails identically to the control |
   | `MAVEN_GPG_PASSPHRASE` | succeeds, good signatures on jar and POM |
   
   Signatures were verified with `gpg --verify`, not merely counted. Also
   confirmed the plugin does not require `allow-loopback-pinentry` to be
   enabled on the release host with GnuPG 2.2.
   
   Note this touches the same two lines as #257; whichever merges second
   will need a small rebase.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@toree.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Pass the GPG passphrase through the environment [incubator-toree]

["lresende (via GitHub)" <gi...@apache.org>]

lresende merged PR #275:
URL: https://github.com/apache/incubator-toree/pull/275


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@toree.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org