You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Sebastiano Vigna <se...@unimi.it> on 2023/03/07 17:19:21 UTC
Signing when staging with Maven Artifact Resolver Ant Task
Sorry to repost this, but we're really stuck. Sonatype will probably at some point update their updated documentation, but it is not clear when.
> On 15 Feb 2023, at 22:48, Sebastiano Vigna <se...@unimi.it> wrote:
>
> Maven Ant Tasks has been retired in favor of Maven Artifact Resolver Ant Tasks. There is no official migration path and the documentation is, well, OK.
>
> We used Maven Ant Tasks to stage our jars into Sonatype for publication in Maven Central. I've been able to almost completely replicate that behavior in Maven Artifact Resolver Ant Tasks, but I haven't been able to sign the jars.
>
> Does anybody know how this should be performed? Previously, I'd add a
>
> <arg value="org.apache.maven.plugins:maven-gpg-plugin:1.3:sign-and-deploy-file" />
>
> in the <artifact:mvn> task. Now I have a <resolve:deploy> task
>
> <resolver:deploy>
> <pom file="pom.xml"/>
> <remoterepo id="${maven-staging-repository-id}" url ="${maven-staging-repository-url}"/>
> <artifact file="${maven-jar}" type="jar"/>
> <artifact file="${maven-sources-jar}" type="jar" classifier="sources"/>
> <artifact file="${maven-javadoc-jar}" type="jar" classifier="javadoc"/>
> </resolver:deploy>
>
> and it works perfectly, but no signing.
>
> Ciao,
>
> seba
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Signing when staging with Maven Artifact Resolver Ant Task
Posted by Sebastiano Vigna <se...@unimi.it>.
> On 7 Mar 2023, at 18:46, Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Yup,
>
> invoke gpg with "--armor --detach-sign", this is what maven plugin does:
> https://github.com/apache/maven-gpg-plugin/blob/master/src/main/java/org/apache/maven/plugins/gpg/GpgSigner.java#L136-L138
OMG thank you so much, that was the missing piece. 🥳
Ciao,
seba
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Signing when staging with Maven Artifact Resolver Ant Task
Posted by Tamás Cservenák <ta...@cservenak.net>.
Yup,
your signatures are wrong, they are not detached as it seems but full
payload?
[cstamas@infinity Downloads]$ gpg --verify dsiutils-2.7.3.jar.asc
dsiutils-2.7.3.jar
gpg: not a detached signature
[cstamas@infinity Downloads]$ gpg --verify dsiutils-2.7.3.jar.asc
gpg: Signature made 2023. márc. 7., kedd, 19:39:36 CET
gpg: using RSA key 0CB5871FB7BF3B351614BBF6CA85FFE638D4407A
gpg: Can't check signature: No public key
[cstamas@infinity Downloads]$
invoke gpg with "--armor --detach-sign", this is what maven plugin does:
https://github.com/apache/maven-gpg-plugin/blob/master/src/main/java/org/apache/maven/plugins/gpg/GpgSigner.java#L136-L138
Also, make sure your public key is available from SKS servers, as Sonatype
Nexus will try to fetch it.
HTH
Tamas
On Tue, Mar 7, 2023 at 7:39 PM Sebastiano Vigna <se...@unimi.it>
wrote:
>
>
> > On 7 Mar 2023, at 17:23, Tamás Cservenák <ta...@cservenak.net> wrote:
> >
> > Howdy
> >
> > Could you just invoke gpg cli (that's what maven gpg plugin does as well)
> > and just add that file as type "jar.asc"?
> >
>
> I tried that. Apart from a lot of manual fliddling (e.g., the new target
> will upload pom.xml, but *not* its signature, etc.) at the end Sonatype
> refuses to valide the signatures. Maybe I have to upload something more,
> but this stuff was set up 20y ago and worked since then like a charm.
> Delving again now in this mess without any migration path is really burning
> me out.
>
> "Failed to validate the pgp signature of
> '/it/unimi/dsi/dsiutils/2.7.3/dsiutils-2.7.3-javadoc.jar', check the logs."
>
> I have looked everywhere in the Sonatype web interface for such logs, with
> no results :(.
>
> Ciao,
>
> seba
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: Signing when staging with Maven Artifact Resolver Ant Task
Posted by Sebastiano Vigna <se...@unimi.it>.
> On 7 Mar 2023, at 17:23, Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Howdy
>
> Could you just invoke gpg cli (that's what maven gpg plugin does as well)
> and just add that file as type "jar.asc"?
>
I tried that. Apart from a lot of manual fliddling (e.g., the new target will upload pom.xml, but *not* its signature, etc.) at the end Sonatype refuses to valide the signatures. Maybe I have to upload something more, but this stuff was set up 20y ago and worked since then like a charm. Delving again now in this mess without any migration path is really burning me out.
"Failed to validate the pgp signature of '/it/unimi/dsi/dsiutils/2.7.3/dsiutils-2.7.3-javadoc.jar', check the logs."
I have looked everywhere in the Sonatype web interface for such logs, with no results :(.
Ciao,
seba
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Signing when staging with Maven Artifact Resolver Ant Task
Posted by Tamás Cservenák <ta...@cservenak.net>.
Howdy
Could you just invoke gpg cli (that's what maven gpg plugin does as well)
and just add that file as type "jar.asc"?
Hth
Tamas
On Tue, Mar 7, 2023, 18:20 Sebastiano Vigna <se...@unimi.it>
wrote:
> Sorry to repost this, but we're really stuck. Sonatype will probably at
> some point update their updated documentation, but it is not clear when.
>
> > On 15 Feb 2023, at 22:48, Sebastiano Vigna <se...@unimi.it>
> wrote:
> >
> > Maven Ant Tasks has been retired in favor of Maven Artifact Resolver Ant
> Tasks. There is no official migration path and the documentation is, well,
> OK.
> >
> > We used Maven Ant Tasks to stage our jars into Sonatype for publication
> in Maven Central. I've been able to almost completely replicate that
> behavior in Maven Artifact Resolver Ant Tasks, but I haven't been able to
> sign the jars.
> >
> > Does anybody know how this should be performed? Previously, I'd add a
> >
> > <arg
> value="org.apache.maven.plugins:maven-gpg-plugin:1.3:sign-and-deploy-file"
> />
> >
> > in the <artifact:mvn> task. Now I have a <resolve:deploy> task
> >
> > <resolver:deploy>
> > <pom file="pom.xml"/>
> > <remoterepo id="${maven-staging-repository-id}" url
> ="${maven-staging-repository-url}"/>
> > <artifact file="${maven-jar}" type="jar"/>
> > <artifact file="${maven-sources-jar}" type="jar" classifier="sources"/>
> > <artifact file="${maven-javadoc-jar}" type="jar" classifier="javadoc"/>
> > </resolver:deploy>
> >
> > and it works perfectly, but no signing.
> >
> > Ciao,
> >
> > seba
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>