Build RPM for AlmaLinux 10 and Sign RPMs

.github/workflows/build-rpm.yaml

@@ -12,7 +12,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [almalinux]
-        version: [8, 9]
+        version: [8, 9, 10]
     outputs:
       repo: ${{ steps.info.outputs.repo }}
       version_pom: ${{ steps.info.outputs.version_pom }}
@@ -22,8 +22,9 @@ jobs:
       - name: Install dependencies
         run: |
           dnf upgrade -y
-          dnf module enable -y maven:3.8
-          dnf install -y git rpmdevtools rpmlint maven-openjdk17
+          [[ "${{ matrix.version }}" -lt 10 ]] && dnf module enable -y maven:3.8
+          [[ "${{ matrix.version }}" = 10 ]] && dnf install -y almalinux-release-devel
+          dnf install -y git maven-openjdk21 rpmdevtools rpmlint rpm-sign
       - name: Setup build tree
         run: |
           echo "%_topdir $(pwd)/rpmbuild" >> ~/.rpmmacros
@@ -63,21 +64,41 @@ jobs:
           echo "Version POM: ${VERSION_POM}"
           echo "Version RPM: ${VERSION_RPM}"
           echo "Repo: ${REPO:-none}"
+      - name: Import GPG key
+        if: ${{ matrix.version != 8 }}
+        env:
+          MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_KEY }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        run: |
+          echo "${MAVEN_GPG_KEY}" > private-key.asc
+          gpg --batch --import-options import-show --import private-key.asc
+          rm private-key.asc
+          gpg --export -a CNAFSD > RPM-GPG-KEY-pmanager
+          rpm --import RPM-GPG-KEY-pmanager
+          echo "%_gpg_name CNAFSD" >> ~/.rpmmacros
+          echo "%_gpg_sign_cmd_extra_args --pinentry-mode loopback --passphrase ${MAVEN_GPG_PASSPHRASE}" >> ~/.rpmmacros
       - name: Build RPM
         run: |
           cp rpmbuild/BUILD/voms-api-java.spec rpmbuild/SPECS/voms-api-java.spec
           rpmlint rpmbuild/SPECS/voms-api-java.spec
           rpmbuild --define "base_version ${VERSION_RPM}" --define "version_pom ${VERSION_POM}" -ba rpmbuild/SPECS/voms-api-java.spec
+          if [[ "${{ matrix.version }}" = 8 ]]; then
+            echo "Skip signing on AlmaLinux 8 to avoid error: RPM-GPG-KEY-pmanager: key 1 import failed"
+            exit 0
+          fi
+          GPG_TTY="" rpm --addsign rpmbuild/RPMS/noarch/*.rpm
       - uses: actions/upload-artifact@v4
         with:
           name: build-rpm-${{ matrix.os }}-${{ matrix.version }}
           path: |
             rpmbuild/RPMS/noarch/*.rpm
       - name: Upload release to repo
         if: env.REPO != ''
+        env:
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
         run: |
           for file in rpmbuild/RPMS/noarch/*.rpm; do
-            curl --fail --user "${{ vars.NEXUS_USERNAME }}:${{ secrets.NEXUS_PASSWORD }}" --upload-file "${file}" https://repo.cloud.cnaf.infn.it/repository/voms-rpm-${REPO}/redhat${{ matrix.version }}/
+            curl --fail --user "${{ vars.NEXUS_USERNAME }}:${NEXUS_PASSWORD}" --upload-file "${file}" https://repo.cloud.cnaf.infn.it/repository/voms-rpm-${REPO}/redhat${{ matrix.version }}/
           done
   create-release:
     needs: build-rpm

voms-api-java.spec

@@ -16,11 +16,11 @@ URL: https://github.com/italiangrid/voms-api-java
 
 BuildArch: noarch
 
-BuildRequires:  maven-openjdk17
+BuildRequires:  maven-openjdk21
 
 Provides:       voms-api-java3 = %{version}
 Requires:       canl-java >= 2.7
-Requires:       java-headless >= 1.8
+Requires:       java-headless >= 1:1.8.0
 
 %description
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@@ -56,9 +56,6 @@ ln -s %{name}-%{version_pom}.jar %{buildroot}%{_javadir}/%{name}.jar
 cp -r target/javadoc/* %{buildroot}%{_javadocdir}/%{name}-%{version_pom}
 ln -s %{name}-%{version_pom} %{buildroot}%{_javadocdir}/%{name}
 
-%clean
-rm -rf %{buildroot}
-
 %files
 %defattr(-,root,root,-)