Skip to content

Commit 823a355

Browse files
adangeladangel
committed
Use gpg signature
1 parent 59a4b72 commit 823a355

File tree

6 files changed

+56
-223
lines changed

6 files changed

+56
-223
lines changed

‎.ci/README.md‎

Lines changed: 21 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,30 @@
11
# Build Scripts for pmd-eclipse-plugin
22

3-
## JAR Signing
3+
## GPG Signing
44

5-
Same solution as <https://github.com/spotbugs/spotbugs/issues/779>, using the Let's Encrypt certificate
6-
for pmd-code.org:
5+
Since 7.9.0, the plugin is signed with the same GPG key, that is used to sign the main PMD artifacts
6+
for maven central.
77

8-
```
9-
$ export CI_SIGN_PASSPHRASE=...
10-
$ openssl pkcs12 -export -in Lets_Encrypt_pmd-code.org_2024-09-26.pem \
11-
-name eclipse-plugin \
12-
-password env:CI_SIGN_PASSPHRASE \
13-
-out pmd-eclipse-plugin.p12 \
14-
-legacy
15-
$ jarsigner -verbose \
16-
-keystore .ci/files/pmd-eclipse-plugin.p12 \
17-
-storepass changeit \
18-
-keypass changeit \
19-
-tsa http://timestamp.digicert.com \
20-
path/to/plugin-jar.jar \
21-
eclipse-plugin
22-
```
8+
See <https://github.com/pmd/build-tools/blob/main/scripts/files/release-signing-key-D0BF1D737C9A1C22.asc>.
239

24-
Note: The file "Lets_Encrypt_pmd-code.org_2024-09-26.pem" contains the private key, the certificate
25-
and intermediate certificates.
10+
Tycho's [GPG Plugin](https://tycho.eclipseprojects.io/doc/latest/tycho-gpg-plugin/sign-p2-artifacts-mojo.html)
11+
is used for that.
2612

27-
Note: with openssl 3, the option `-legacy` is required in order to use the pkcs12 keystore with java8.
28-
See <https://stackoverflow.com/questions/69170537/is-openssl-v3-0-0-compatible-with-v1-1-1>
13+
There is no need anymore to use jar signer and use a real Let's Encrypt certificate.
2914

30-
The file `pmd-eclipse-plugin.p12` is stored as `.ci/files/pmd-eclipse-plugin.p12.asc`, encrypted with PMD_CI_SECRET_PASSPHRASE.
15+
**How it works:**
3116

32-
Encrypt it via:
17+
* During build setup, `.m2/settings.xml` contains properties for signing:
18+
```xml
19+
<profile>
20+
<id>sign</id>
21+
<properties>
22+
<gpg.keyname>${env.CI_SIGN_KEYNAME}</gpg.keyname>
23+
<gpg.passphrase>${env.CI_SIGN_PASSPHRASE}</gpg.passphrase>
24+
</properties>
25+
</profile>
26+
```
27+
* These environment variables (`CI_SIGN_KEYNAME`) are set by `pmd_ci_setup_secrets_private_env`
28+
which is called by `build.sh` (but not for pull requests).
3329

34-
printenv PMD_CI_SECRET_PASSPHRASE | gpg --symmetric --cipher-algo AES256 --batch --armor \
35-
--passphrase-fd 0 \
36-
pmd-eclipse-plugin.p12
37-
38-
Decrypt it via:
39-
40-
printenv PMD_CI_SECRET_PASSPHRASE | gpg --batch --yes --decrypt \
41-
--passphrase-fd 0 \
42-
--output pmd-eclipse-plugin.p12 pmd-eclipse-plugin.p12.asc
43-
chmod 600 pmd-eclipse-plugin.p12
44-
45-
Signing the jar manually via `jarsigner` is difficult, since it changes the jar file and the p2 repo metadata
46-
fails with the wrong checksum. Therefore jarsigning is integrated via [maven-jarsigner-plugin](https://maven.apache.org/plugins/maven-jarsigner-plugin/). See also <https://stackoverflow.com/questions/7956267/tycho-jar-signing>.
47-
48-
Note: The Let's Encrypt certificate is valid until 2024-12-25. But while signing a digital timestamp is created
49-
using [DigiCert's Timestamp Server](https://knowledge.digicert.com/generalinformation/INFO4231.html). That's
50-
why the signature is valid longer than the certificate.
51-
52-
Note: Eclipse 2022-03 seems to check now the expiration date of the certificates.
53-
See <https://bugs.eclipse.org/bugs/show_bug.cgi?id=578024>.
30+
* The tycho gpg plugin is activated only when profile `sign` is activated.

‎.ci/build.sh‎

Lines changed: 2 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ function build() {
5151
pmd_ci_setup_secrets_private_env
5252
pmd_ci_setup_secrets_ssh
5353
pmd_ci_maven_setup_settings
54-
extract_keystore
5554
pmd_ci_log_group_end
5655

5756
if pmd_ci_maven_isSnapshotBuild; then
@@ -68,17 +67,10 @@ function snapshot_build() {
6867
pmd_ci_log_group_start "Snapshot Build: ${PMD_CI_MAVEN_PROJECT_VERSION}"
6968
pmd_ci_log_info "This is a snapshot build on branch ${PMD_CI_BRANCH} (version: ${PMD_CI_MAVEN_PROJECT_VERSION})"
7069

71-
# Build 1 - without signing but with tests
72-
${xvfb_cmd} ./mvnw clean verify \
73-
--show-version --errors --batch-mode --no-transfer-progress \
74-
-Dtarget.platform=${TARGET_PLATFORM}
75-
76-
# Build 2 - with signing, but skipping tests, pmd, checkstyle
7770
${xvfb_cmd} ./mvnw clean verify \
7871
--show-version --errors --batch-mode --no-transfer-progress \
7972
--activate-profiles sign \
80-
-Dtarget.platform=${TARGET_PLATFORM} \
81-
-Dpmd.skip=true -DskipTests -Dcheckstyle.skip
73+
-Dtarget.platform=${TARGET_PLATFORM}
8274

8375
# Upload update site to sourceforge
8476
local qualifiedVersion
@@ -125,17 +117,10 @@ function release_build() {
125117
pmd_ci_log_group_start "Release Build: ${PMD_CI_MAVEN_PROJECT_VERSION}"
126118
pmd_ci_log_info "This is a release build for tag ${PMD_CI_TAG} (version: ${PMD_CI_MAVEN_PROJECT_VERSION})"
127119

128-
# Build 1 - without signing but with tests
129-
${xvfb_cmd} ./mvnw clean verify \
130-
--show-version --errors --batch-mode --no-transfer-progress \
131-
-Dtarget.platform=${TARGET_PLATFORM}
132-
133-
# Build 2 - with signing, but skipping tests, pmd, checkstyle
134120
${xvfb_cmd} ./mvnw clean verify \
135121
--show-version --errors --batch-mode --no-transfer-progress \
136122
--activate-profiles sign \
137-
-Dtarget.platform=${TARGET_PLATFORM} \
138-
-Dpmd.skip=true -DskipTests -Dcheckstyle.skip
123+
-Dtarget.platform=${TARGET_PLATFORM}
139124

140125
pmd_ci_log_group_end
141126

@@ -289,13 +274,4 @@ For older versions, see <https://sourceforge.net/projects/pmd/files/pmd-eclipse/
289274
" > index.md
290275
}
291276

292-
function extract_keystore() {
293-
local -r keystore=".ci/files/pmd-eclipse-plugin.p12"
294-
pmd_ci_log_info "Extracting keystore ${keystore}..."
295-
printenv PMD_CI_SECRET_PASSPHRASE | gpg --batch --yes --decrypt \
296-
--passphrase-fd 0 \
297-
--output "${keystore}" "${keystore}.asc"
298-
chmod 600 "${keystore}"
299-
}
300-
301277
build

‎.ci/files/pmd-eclipse-plugin.p12.asc‎

Lines changed: 0 additions & 125 deletions
This file was deleted.

‎ReleaseNotes.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ This is a minor release.
1414
### New and noteworthy
1515
* Support for Eclipse 2024-12 added
1616
* Support for Eclipse 2023-12 removed
17+
* The plugin now uses GPG signatures. Releases are signed with
18+
[D0BF1D737C9A1C22](https://keyserver.ubuntu.com/pks/lookup?search=D0BF1D737C9A1C22&fingerprint=on&op=index).
19+
The full fingerprint is `EBB2 41A5 45CB 17C8 7FAC B2EB D0BF 1D73 7C9A 1C22`.
1720

1821
### Fixed Issues
1922

‎net.sourceforge.pmd.eclipse.p2updatesite/pom.xml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,26 @@
3636
</plugin>
3737
</plugins>
3838
</build>
39+
40+
<profiles>
41+
<profile>
42+
<id>sign</id>
43+
<build>
44+
<plugins>
45+
<plugin>
46+
<groupId>org.eclipse.tycho</groupId>
47+
<artifactId>tycho-gpg-plugin</artifactId>
48+
<executions>
49+
<execution>
50+
<id>sign</id>
51+
<goals>
52+
<goal>sign-p2-artifacts</goal>
53+
</goals>
54+
</execution>
55+
</executions>
56+
</plugin>
57+
</plugins>
58+
</build>
59+
</profile>
60+
</profiles>
3961
</project>

‎pom.xml‎

Lines changed: 8 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,14 @@
332332
<artifactId>tycho-bnd-plugin</artifactId>
333333
<version>${tycho.version}</version>
334334
</plugin>
335+
<plugin>
336+
<groupId>org.eclipse.tycho</groupId>
337+
<artifactId>tycho-gpg-plugin</artifactId>
338+
<version>${tycho.version}</version>
339+
<configuration>
340+
<bestPractices>true</bestPractices>
341+
</configuration>
342+
</plugin>
335343
<plugin>
336344
<groupId>org.apache.maven.plugins</groupId>
337345
<artifactId>maven-checkstyle-plugin</artifactId>
@@ -508,33 +516,5 @@
508516
</pluginManagement>
509517
</build>
510518
</profile>
511-
512-
<profile>
513-
<id>sign</id>
514-
<build>
515-
<plugins>
516-
<plugin>
517-
<groupId>org.apache.maven.plugins</groupId>
518-
<artifactId>maven-jarsigner-plugin</artifactId>
519-
<version>3.0.0</version>
520-
<configuration>
521-
<alias>eclipse-plugin</alias>
522-
<keystore>${keystore}</keystore>
523-
<keypass>${env.CI_SIGN_PASSPHRASE}</keypass>
524-
<storepass>${env.CI_SIGN_PASSPHRASE}</storepass>
525-
<tsa>http://timestamp.digicert.com</tsa>
526-
</configuration>
527-
<executions>
528-
<execution>
529-
<id>sign</id>
530-
<goals>
531-
<goal>sign</goal>
532-
</goals>
533-
</execution>
534-
</executions>
535-
</plugin>
536-
</plugins>
537-
</build>
538-
</profile>
539519
</profiles>
540520
</project>

0 commit comments

Comments
 (0)