Skip to content

Commit 1b88424

Browse files
loosebazookaloosebazooka
committed
add pgp signing to examples
Signed-off-by: Appu Goundan <[email protected]>
1 parent 0a0e2d8 commit 1b88424

File tree

9 files changed

+127
-22
lines changed

9 files changed

+127
-22
lines changed

‎.github/workflows/examples.yaml

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -34,28 +34,17 @@ jobs:
3434

3535
- name: run examples against released sigstore
3636
working-directory: examples/hello-world
37-
run: |
38-
set -Eexo pipefail
39-
./gradlew clean publishMavenPublicationToExamplesRepository
40-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
41-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.module.sigstore.json
42-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
43-
mvn clean deploy --no-transfer-progress
44-
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
45-
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
37+
run: ./test.sh
4638

4739
- name: install sigstore java development jars into mavenLocal
4840
run: ./gradlew publishToMavenLocal -Prelease -PskipSigning
4941

42+
- name: calculate development version
43+
id: dev_version
44+
run: |
45+
set -Exeo pipefail
46+
echo "version=$(grep "^version=" gradle.properties | cut -d'=' -f2)" >> $GITHUB_OUTPUT
47+
5048
- name: run examples against development version
5149
working-directory: examples/hello-world
52-
run: |
53-
set -Eexo pipefail
54-
version="$(grep "^version=" ../../gradle.properties | cut -d'=' -f2)"
55-
./gradlew clean publishMavenPublicationToExamplesRepository -Dsigstore.version=$version
56-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
57-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.module.sigstore.json
58-
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
59-
mvn clean deploy -Dsigstore.version=$version --no-transfer-progress
60-
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
61-
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
50+
run: ./test.sh -Dsigstore.version=${{ steps.dev_version.outputs.version }}

‎examples/hello-world/README.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,28 @@
22

33
Simple sigstore signing examples
44

5+
These examples sign with sigstore (and PGP as required by Maven Central)
6+
57
## gradle
68

79
```
10+
$ export ORG_GRADLE_PROJECT_signingKey=$(cat ../pgp/private.key)
11+
$ export ORG_GRADLE_PROJECT_signingPassword=pass123
12+
813
$ ./gradlew clean publishMavenPublicationToExamplesRepository
914
1015
$ ls build/example-repo/com/example/hello-world/1.0.0/*.sigstore.json
11-
hellow-world-1.0.0.jar.sigstore.json
12-
hellow-world-1.0.0.modules.sigstore.json
13-
hellow-world-1.0.0.pom.sigstore.json
16+
hello-world-1.0.0.jar.sigstore.json
17+
hello-world-1.0.0.modules.sigstore.json
18+
hello-world-1.0.0.pom.sigstore.json
1419
```
1520

1621
## maven
1722

1823
```
24+
$ export MAVEN_GPG_KEY=$(cat ../pgp/private.key)
25+
$ export MAVEN_GPG_PASSPHRASE=pass123
26+
1927
$ mvn clean deploy
2028
2129
$ ls target/example-repo/com/example/hello-world/1.0.0/*.sigstore.json

‎examples/hello-world/build.gradle.kts

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ plugins {
33
`maven-publish`
44
val sigstoreVersion = System.getProperty("sigstore.version") ?: "0.11.0"
55
id("dev.sigstore.sign") version "$sigstoreVersion"
6+
signing
67
}
78

89
version = "1.0.0"
@@ -27,3 +28,13 @@ publishing {
2728
}
2829
}
2930
}
31+
32+
// sigstore signing doesn't require additional setup in build.gradle.kts
33+
34+
// PGP signing setup for the purposes of this example.
35+
signing {
36+
val signingKey: String? by project
37+
val signingPassword: String? by project
38+
useInMemoryPgpKeys(signingKey, signingPassword)
39+
sign(publishing.publications["maven"])
40+
}

‎examples/hello-world/pom.xml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
<artifactId>maven-compiler-plugin</artifactId>
2626
<version>3.13.0</version>
2727
</plugin>
28+
<!-- sigstore signing config -->
2829
<plugin>
2930
<groupId>dev.sigstore</groupId>
3031
<artifactId>sigstore-maven-plugin</artifactId>
@@ -35,6 +36,26 @@
3536
<goals>
3637
<goal>sign</goal>
3738
</goals>
39+
<!-- no config, sign using browser or CI credentials -->
40+
</execution>
41+
</executions>
42+
</plugin>
43+
<!-- pgp signing config -->
44+
<plugin>
45+
<groupId>org.apache.maven.plugins</groupId>
46+
<artifactId>maven-gpg-plugin</artifactId>
47+
<version>3.2.5</version>
48+
<executions>
49+
<execution>
50+
<id>sign</id>
51+
<phase>verify</phase>
52+
<goals>
53+
<goal>sign</goal>
54+
</goals>
55+
<configuration>
56+
<!-- read key and passphrase from env -->
57+
<signer>bc</signer>
58+
</configuration>
3859
</execution>
3960
</executions>
4061
</plugin>

‎examples/hello-world/test.sh

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/usr/bin/env bash
2+
set -Eeo pipefail
3+
export MAVEN_GPG_KEY=$(cat ../pgp/private.key)
4+
export MAVEN_GPG_PASSPHRASE=pass123
5+
export ORG_GRADLE_PROJECT_signingKey=$MAVEN_GPG_KEY
6+
export ORG_GRADLE_PROJECT_signingPassword=$MAVEN_GPG_PASSPHRASE
7+
set -x
8+
# gradle
9+
./gradlew clean publishMavenPublicationToExamplesRepository $@
10+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
11+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.module.sigstore.json
12+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
13+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.asc
14+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.module.asc
15+
test -f build/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.asc
16+
# maven
17+
mvn clean deploy --no-transfer-progress $@
18+
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.sigstore.json
19+
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.sigstore.json
20+
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.jar.asc
21+
test -f target/example-repo/com/example/hello-world/1.0.0/hello-world-1.0.0.pom.asc
22+
# ensure no double signed (pgp and sigstore) files
23+
test $(find . -name "*.asc.sigstore.java" | wc -c) -eq 0
24+
test $(find . -name "*.sigstore.java.asc" | wc -c) -eq 0

‎examples/pgp/README.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
## PGP test keys for examples
2+
3+
```
4+
$ gpg --quick-gen-key "Test Key (DO NOT USE) <[email protected]>" rsa1024 sign never
5+
6+
passphrase:pass123
7+
8+
$ gpg --output private.key --armor --export-secret-key [email protected]
9+
$ gpg --output public.key --armor --export [email protected]
10+
```

‎examples/pgp/keygen.input

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Key-Type: RSA
2+
Key-Length: 4096
3+
Key-Expiration: 0
4+
Name: Example Test Key
5+
Email Address: [email protected]
6+
Comment: DO NOT USE
7+
Passphrase: pass123
8+
Repeat the passphrase: pass123

‎examples/pgp/private.key

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN PGP PRIVATE KEY BLOCK-----
2+
3+
lQIGBGa87ksBBACstX51gCUmdttBgisnx3zurn7+8hB6PnGrlZGgFBPn+SFopGCe
4+
u1cZgzMpZ67uDSXp2kxSgpCisBPYeUMLQ1WTijIo7E6mowKhBsnepa/siVeiJXP1
5+
LvvtLmQyMVDAArBcsSF4nTqb6voOuqxePvC/k0FwNIBqx0lGL9tBjg4KNwARAQAB
6+
/gcDAmxZ2B3s2wUt//cWOHgEPQQrzvTqJ3Gmx7eSlk3J7ITj62XxgtBbjyWXnPEN
7+
klWMyY7BpLWYzaJ3pVoHtLLEIAZpHkV0TUS6z6dqDqGs9RtzsYFBDGKk6BXGx6A7
8+
NLJZmMJuhyjScTNc62ul5zkFFK/51P4OE09ZTErticmD+TGxUNTO4dM2zWvb17mv
9+
9uL3lRX94DNAO1dv6fC4dJXT8XMeuc9IKacLXCaWq0cgE+rA1gAhGmMPIqOgTC1s
10+
AKngqROhuaJhXLR/bucPVCFRc29cb42RN+ujgaw/vv0M2MGCclrlyG5ic7K0YqmJ
11+
opsf+dXm6ktCYj+bGDjm1avZ1qCb9vqpNyZ4DGFf/zBl+f7Cf2fdLpuYFUNN6VNt
12+
adL06NbSJ8LJhaloLN8W2G226Av4NhS9l69PVkEBYBwgwvGg7b1GORdi+iIsG6Z/
13+
3jS9xAPUgvYymIQdsNOw7Hv83F7pw/2gPPlBG7xhdfAm/uWFijtYOCC0KFRlc3Qg
14+
S2V5IChETyBOT1QgVVNFKSA8dGVzdEBleGFtcGxlLmNvbT6IzgQTAQoAOBYhBBv4
15+
2FTtpf8iZ6LK8WaHWakuSNF5BQJmvO5LAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4B
16+
AheAAAoJEGaHWakuSNF5YicD/1bbCo0/S5dY1U3q7QNXKAGAIF28hd1tM7JMZ04q
17+
Qa56usj6+bzbCVax7CQ9ghnTYgifGOS5462KIBLzNokn/HPPRkGuac42uY67SGEV
18+
pd93ha7bqZUB3IuWLO2HKNXxN1AE0wTwTMW85sxSsGeUye9/dgQvpzPXbPLV5R4c
19+
Q7cN
20+
=sfrl
21+
-----END PGP PRIVATE KEY BLOCK-----

‎examples/pgp/public.key

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mI0EZrzuSwEEAKy1fnWAJSZ220GCKyfHfO6ufv7yEHo+cauVkaAUE+f5IWikYJ67
4+
VxmDMylnru4NJenaTFKCkKKwE9h5QwtDVZOKMijsTqajAqEGyd6lr+yJV6Ilc/Uu
5+
++0uZDIxUMACsFyxIXidOpvq+g66rF4+8L+TQXA0gGrHSUYv20GODgo3ABEBAAG0
6+
KFRlc3QgS2V5IChETyBOT1QgVVNFKSA8dGVzdEBleGFtcGxlLmNvbT6IzgQTAQoA
7+
OBYhBBv42FTtpf8iZ6LK8WaHWakuSNF5BQJmvO5LAhsDBQsJCAcCBhUKCQgLAgQW
8+
AgMBAh4BAheAAAoJEGaHWakuSNF5YicD/1bbCo0/S5dY1U3q7QNXKAGAIF28hd1t
9+
M7JMZ04qQa56usj6+bzbCVax7CQ9ghnTYgifGOS5462KIBLzNokn/HPPRkGuac42
10+
uY67SGEVpd93ha7bqZUB3IuWLO2HKNXxN1AE0wTwTMW85sxSsGeUye9/dgQvpzPX
11+
bPLV5R4cQ7cN
12+
=vt0B
13+
-----END PGP PUBLIC KEY BLOCK-----

0 commit comments

Comments
 (0)