Repository navigation
ci: sign releases with the new release key, and check secrets first - #191
Merged
Merged
Conversation
The release key 8541784E4EC36FB8 could not sign in GitHub Actions: its private half was only in the retired Woodpecker pipeline's secrets, so v2.1.2's "Build, sign and publish to Maven Central" failed with "No secret key" and never published. Releases are now signed with a new key, F844278E3B5F9051 (fingerprint 0167FEA3204A35D8C1E11EE9F844278E3B5F9051), held in MAVEN_GPG_PRIVATE_KEY and MAVEN_GPG_PASSPHRASE and published on keyserver.ubuntu.com, where Central checks signatures. release.yml now fails before anything is built or signed, naming each release secret that is missing, as keploy-junit5-release.yml already did. SECURITY.md lists the fingerprints of both keys and how to check a file. Signed-off-by: slayerjain <shubhamkjain@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v2.1.2 never reached Maven Central. Its release run failed at "Build, sign and publish to Maven Central" with
gpg: skipped "8541784E4EC36FB8": No secret key. The private half of that key lived only in the retired Woodpecker pipeline's secrets, so GitHub Actions could not sign with it.What changes
F844278E3B5F9051, fingerprint0167FEA3204A35D8C1E11EE9F844278E3B5F9051. The repository'sMAVEN_GPG_PRIVATE_KEYandMAVEN_GPG_PASSPHRASEsecrets now hold it. Its public half is on keyserver.ubuntu.com, which Central uses to check signatures.GPG_KEY_IDchanges inrelease.ymlandkeploy-junit5-release.yml.release.ymlgets a first step that fails before anything is built or signed, naming each release secret that is missing (CENTRAL_USERNAME,CENTRAL_PASSWORD,MAVEN_GPG_PRIVATE_KEY,MAVEN_GPG_PASSPHRASE).keploy-junit5-release.ymlalready has this check. Without it, an empty key or passphrase showed up only partway through signing.SECURITY.mdlists both keys' fingerprints (the new one from v2.1.3 on, the old one up to v2.1.1) and how to verify a release file.Checked
-Dgpg.keynamewith the primary id selects its signing subkey (12D73514C705018D).After merge
The next release, v2.1.3, carries #190 and is the first one signed with the new key.