Sign artifacts only in the release profile - #17
Merged
Conversation
maven-gpg-plugin was bound to the verify phase outside any profile, so every `mvn install` and `mvn verify` attempted to sign the artifacts. On a machine without a GPG key and a working pinentry the build failed after the full test suite had already passed, with an error that has nothing to do with the code under test. docs/BUILDING.md has always documented signing as a release step (`mvn clean package -P release`), and listed "GPG configured for signing" as a prerequisite for it. The POM had no such profile, so the documented contract and the build disagreed. This adds the profile the documentation already describes. Verified both directions: - `mvn clean install` now reaches BUILD SUCCESS with no signing step - `mvn verify -Prelease` still runs gpg:sign
marevol
added a commit
that referenced
this pull request
Sep 6, 2026
… build (#21) The 2.4.11 deployment was rejected by the Central Portal: Sources must be provided but not found in entries Javadocs must be provided but not found in entries Missing signature for file: yuicompressor-2.4.11.pom Missing signature for file: yuicompressor-2.4.11.jar Only the jar and the POM were uploaded, for two independent reasons. Signing moved into the `release` profile in #17, but nothing activates that profile: release:perform runs its forked deploy build without it, because the POM never configured <releaseProfiles>. The POM has also never declared maven-source-plugin, and maven-javadoc-plugin carries no `jar` execution. Those artifacts used to come from the super POM's implicit release-profile, which is activated by performRelease=true; maven-release-plugin 3.x defaults useReleaseProfile to false, so that property is no longer passed and the profile no longer applies. maven-release-plugin is now pinned at 3.3.1 with <releaseProfiles>release</releaseProfiles>, and the release profile declares maven-source-plugin and the attach-javadocs execution alongside the GPG signing, so `mvn deploy -P release` and `mvn release:perform` both produce the signed jar, sources, javadoc and POM. Verified: - `mvn clean verify -Prelease -DskipTests -Dgpg.skip=true` builds the jar, the sources jar and the javadoc jar - `help:effective-pom -Prelease` places source, javadoc and gpg in the active build; without the profile all three stay inside the inactive profile, so `mvn install` still succeeds unsigned, which is the behaviour #17 restored - GPG signing itself was not exercised here: it was skipped to avoid a passphrase prompt, so run `mvn clean verify -Prelease` once before releasing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
maven-gpg-pluginis bound to theverifyphase outside any profile, so everymvn installandmvn verifyattempts to sign the artifacts. On a machinewithout a GPG key and a working pinentry the build fails after the full test
suite has already passed:
docs/BUILDING.mdhas always described signing as a release step:There was no such profile in the POM, so the documented contract and the build
disagreed.
Change
Adds the
releaseprofile the documentation already describes and moves thesigning execution into it. No change to how signing itself is configured.
Verification
mvn clean install->BUILD SUCCESS, no signing stepmvn verify -Prelease->gpg:3.2.7:signruns (fails on this machine only forlack of a pinentry, which is what proves it is still wired)
CI is unaffected: the workflow runs
mvn package/mvn test, both of whichstop before
verify.