You are viewing a plain text version of this content. The canonical link for it is here.
Posted to builds@apache.org by Rick Hillegas <ri...@gmail.com> on 2022/06/08 23:22:17 UTC
problem using maven to gpg-sign to and upload release artifacts to the nexus repository
I am having trouble signing maven artifacts for a new Derby release
(10.16.1.1). The details of the problem are described at
https://issues.apache.org/jira/browse/INFRA-23348. The release itself is
published on the Apache mirrors and can be downloaded from
https://db.apache.org/derby/releases/release-10_16_1_1.cgi. The Apache
distros listed on that web page have gpg signatures and SHA-512 checksums.
But our release process calls for unpacking the distros and publishing
the contained jar files to maven repositories, along with maven poms
which declare the dependencies between the jar files. This is where I am
stuck. I have managed to push the jars and poms to the Nexus repository
along with corresponding md5 and sha1 checksums. I have also gpg-signed
the jars and poms by hand. But I don't know how to push the signatures
to Nexus.
I would appreciate answers to the following questions:
1) Is publication to maven repositories required for Apache releases or
is publication to the mirrors good enough?
2) Are gpg signatures required for the maven artifacts staged at Nexus?
If not, then I will just release the artifacts and checksums into the
wild and wrap up the publication process.
2) But if maven publication is required and gpg signatures are
required...How do I debug my problem with using maven to push signatures
to Nexus? The maven error message is terse. No additional useful
information comes back when I run the maven command with -e and -X
switches. I haven't found any useful information on the web.
For the record, this is the command which fails...
mvn -Dgpg.passphrase="blah blah blah my passphrase" clean deploy
...and this is the error message I see:
[ERROR] Failed to execute goal
org.apache.maven.plugins:maven-gpg-plugin:1.3:sign (sign-artifacts) on
project derby-project: Exit code: 2 -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to
execute goal org.apache.maven.plugins:maven-gpg-plugin:1.3:sign
(sign-artifacts) on project derby-project: Exit code: 2
Thanks,
-Rick
Re: problem using maven to gpg-sign to and upload release artifacts to the nexus repository
Posted by Allen Wittenauer <aw...@effectivemachines.com.INVALID>.
> On Jun 9, 2022, at 7:51 AM, Rick Hillegas <ri...@gmail.com> wrote:
>
> Thanks for the quick response, Maxim.
>
> Yes, my credentials are in ~/.m2/settings.xml. Maven is able to upload artifacts and checksums, so the credentials are good. It's the gpg-signing bit that's broken.
>
> No, I can't ssh to repository.apache.org:
>
> mainline (17) > ssh rhillegas@repository.apache.org
> rhillegas@repository.apache.org: Permission denied (publickey)
Last I checked, the maven-gpg-plugin (which is what gets called under the hood, IIRC) needs to be told which type of gpg you are using on some versions. So you might need to configure it for your particular build environment. For Apache Yetus, we setup a profile to do that:
https://github.com/apache/yetus/blob/fae6b390b06c0f1752fc15221cea4b9cdb7d44dc/pom.xml#L264
Re: problem using maven to gpg-sign to and upload release artifacts to the nexus repository
Posted by Rick Hillegas <ri...@gmail.com>.
Thanks for the quick response, Maxim.
Yes, my credentials are in ~/.m2/settings.xml. Maven is able to upload
artifacts and checksums, so the credentials are good. It's the
gpg-signing bit that's broken.
No, I can't ssh to repository.apache.org:
mainline (17) > ssh rhillegas@repository.apache.org
rhillegas@repository.apache.org: Permission denied (publickey).
On 6/8/22 6:01 PM, Maxim Solodovnik wrote:
> Hello Rick,
>
> The error message from INFRA ticket is unauthorized
>
> Can you login to repository.a.o?
> Do you have your (crypted) password for repository.a.o in maven
> settings.xml?
>
> from mobile (sorry for typos ;)
>
>
> On Thu, Jun 9, 2022, 06:22 Rick Hillegas <ri...@gmail.com> wrote:
>
>> I am having trouble signing maven artifacts for a new Derby release
>> (10.16.1.1). The details of the problem are described at
>> https://issues.apache.org/jira/browse/INFRA-23348. The release itself is
>> published on the Apache mirrors and can be downloaded from
>> https://db.apache.org/derby/releases/release-10_16_1_1.cgi. The Apache
>> distros listed on that web page have gpg signatures and SHA-512 checksums.
>>
>> But our release process calls for unpacking the distros and publishing
>> the contained jar files to maven repositories, along with maven poms
>> which declare the dependencies between the jar files. This is where I am
>> stuck. I have managed to push the jars and poms to the Nexus repository
>> along with corresponding md5 and sha1 checksums. I have also gpg-signed
>> the jars and poms by hand. But I don't know how to push the signatures
>> to Nexus.
>>
>> I would appreciate answers to the following questions:
>>
>> 1) Is publication to maven repositories required for Apache releases or
>> is publication to the mirrors good enough?
>>
>> 2) Are gpg signatures required for the maven artifacts staged at Nexus?
>> If not, then I will just release the artifacts and checksums into the
>> wild and wrap up the publication process.
>>
>> 2) But if maven publication is required and gpg signatures are
>> required...How do I debug my problem with using maven to push signatures
>> to Nexus? The maven error message is terse. No additional useful
>> information comes back when I run the maven command with -e and -X
>> switches. I haven't found any useful information on the web.
>>
>> For the record, this is the command which fails...
>>
>> mvn -Dgpg.passphrase="blah blah blah my passphrase" clean deploy
>>
>> ...and this is the error message I see:
>>
>> [ERROR] Failed to execute goal
>> org.apache.maven.plugins:maven-gpg-plugin:1.3:sign (sign-artifacts) on
>> project derby-project: Exit code: 2 -> [Help 1]
>> org.apache.maven.lifecycle.LifecycleExecutionException: Failed to
>> execute goal org.apache.maven.plugins:maven-gpg-plugin:1.3:sign
>> (sign-artifacts) on project derby-project: Exit code: 2
>>
>> Thanks,
>> -Rick
>>
>>
Re: problem using maven to gpg-sign to and upload release artifacts to the nexus repository
Posted by Maxim Solodovnik <so...@gmail.com>.
Hello Rick,
The error message from INFRA ticket is unauthorized
Can you login to repository.a.o?
Do you have your (crypted) password for repository.a.o in maven
settings.xml?
from mobile (sorry for typos ;)
On Thu, Jun 9, 2022, 06:22 Rick Hillegas <ri...@gmail.com> wrote:
> I am having trouble signing maven artifacts for a new Derby release
> (10.16.1.1). The details of the problem are described at
> https://issues.apache.org/jira/browse/INFRA-23348. The release itself is
> published on the Apache mirrors and can be downloaded from
> https://db.apache.org/derby/releases/release-10_16_1_1.cgi. The Apache
> distros listed on that web page have gpg signatures and SHA-512 checksums.
>
> But our release process calls for unpacking the distros and publishing
> the contained jar files to maven repositories, along with maven poms
> which declare the dependencies between the jar files. This is where I am
> stuck. I have managed to push the jars and poms to the Nexus repository
> along with corresponding md5 and sha1 checksums. I have also gpg-signed
> the jars and poms by hand. But I don't know how to push the signatures
> to Nexus.
>
> I would appreciate answers to the following questions:
>
> 1) Is publication to maven repositories required for Apache releases or
> is publication to the mirrors good enough?
>
> 2) Are gpg signatures required for the maven artifacts staged at Nexus?
> If not, then I will just release the artifacts and checksums into the
> wild and wrap up the publication process.
>
> 2) But if maven publication is required and gpg signatures are
> required...How do I debug my problem with using maven to push signatures
> to Nexus? The maven error message is terse. No additional useful
> information comes back when I run the maven command with -e and -X
> switches. I haven't found any useful information on the web.
>
> For the record, this is the command which fails...
>
> mvn -Dgpg.passphrase="blah blah blah my passphrase" clean deploy
>
> ...and this is the error message I see:
>
> [ERROR] Failed to execute goal
> org.apache.maven.plugins:maven-gpg-plugin:1.3:sign (sign-artifacts) on
> project derby-project: Exit code: 2 -> [Help 1]
> org.apache.maven.lifecycle.LifecycleExecutionException: Failed to
> execute goal org.apache.maven.plugins:maven-gpg-plugin:1.3:sign
> (sign-artifacts) on project derby-project: Exit code: 2
>
> Thanks,
> -Rick
>
>
Re: problem using maven to gpg-sign to and upload release artifacts to the nexus repository
Posted by "P. Ottlinger" <po...@apache.org>.
Hi Rick,
apart from the stuff Maxim mentioned I needed to pass my apache
credentials during the release:
$ mvn release:perform -Dusername=yourApacheId -Dpassword=yourPW
HTH
Phil
Am 09.06.22 um 01:22 schrieb Rick Hillegas:
> 2) But if maven publication is required and gpg signatures are
> required...How do I debug my problem with using maven to push signatures
> to Nexus? The maven error message is terse. No additional useful
> information comes back when I run the maven command with -e and -X
> switches. I haven't found any useful information on the web.
>
> For the record, this is the command which fails...
>
> mvn -Dgpg.passphrase="blah blah blah my passphrase" clean deploy
>
> ...and this is the error message I see:
>
> [ERROR] Failed to execute goal
> org.apache.maven.plugins:maven-gpg-plugin:1.3:sign (sign-artifacts) on
> project derby-project: Exit code: 2 -> [Help 1]
> org.apache.maven.lifecycle.LifecycleExecutionException: Failed to
> execute goal org.apache.maven.plugins:maven-gpg-plugin:1.3:sign
> (sign-artifacts) on project derby-project: Exit code: 2