My knowledge of this stuff has gotten rusty. What I remember: I had to do special work since Gradle didn't have support for generating BOMs. The generation process is kind of finicky because various stages need to run in order and that order isn't obvious based on the structure of the build rules; it must be that the signing stage doesn't see the generated pom file. If you just want to get the release unblocked, you might have to either 1) add a hack to generate the asc file at the right stage, or 2) downgrade Gradle. Also, it's worth checking to see if Gradle 6 now has support for generating BOMs, which it didn't used to have, but that would be a bigger change than you might want to accept for unblocking the release.
-- Garrett Jones [ go/garrettjones-user-manual | go/reconsider-inline-replies ] On Wed, Oct 14, 2020 at 8:07 PM Kenneth Knowles <[email protected]> wrote: > +Garrett Jones <[email protected]> who appears to have been > involved and +Michael Luckey <[email protected]> who has touched this > build.gradle (according to git) and is a bit of a build wizard. > > Kenn > > On Wed, Oct 14, 2020 at 7:34 PM Robin Qiu <[email protected]> wrote: > >> Hi all, >> >> I am working on creating Beam 2.25.0 RC1. The repo I created ( >> https://repository.apache.org/#stagingRepositories) failed to close >> because >> >> Missing Signature: >>> '/org/apache/beam/beam-sdks-java-bom/2.25.0/beam-sdks-java-bom-2.25.0.pom.asc' >>> does not exist for 'beam-sdks-java-bom-2.25.0.pom'. >> >> >> I checked pom files in other modules and their signatures are present, so >> I think this problem only happens to beam-sdks-java-bom-2.25.0.pom. Also >> this has not happened in previous releases. I suspect this is caused by the >> recent upgrade to Gradle 6. >> >> I found that >> https://github.com/apache/beam/blob/master/sdks/java/bom/build.gradle >> does something special. It does not use a generated pom, instead it uses >> its own template and copies that >> to sdks/java/bom/build/publications/mavenJava/ as pom-default.xml. When I >> run the publish task locally, I found in >> sdks/java/bom/build/publications/mavenJava/ that the pom-default.xml is >> signed (i.e. pom-default.xml.asc is present), but >> beam-sdks-java-bom-2.25.0.pom is not signed (i.e. >> beam-sdks-java-bom-2.25.0.pom.asc is not present) in the output repository. >> >> I tried to understand how the Gradle plugins (maven-publish and signing) >> work and changed a few different configurations in >> https://github.com/apache/beam/blob/master/sdks/java/bom/build.gradle >> but that didn't help. Does anyone have context on this issue or have any >> suggestions that I could try? This is currently blocking the 2.25.0 release. >> >> Thanks, >> Robin >> >> -- >> You received this message because you are subscribed to the Google Groups >> "datapls-plat-team" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/a/google.com/d/msgid/datapls-plat-team/CA%2BVw4HU8wfux9OUf9Kt_V5q221WrEhHqYwaq_fCSk4ViqddJuA%40mail.gmail.com >> <https://groups.google.com/a/google.com/d/msgid/datapls-plat-team/CA%2BVw4HU8wfux9OUf9Kt_V5q221WrEhHqYwaq_fCSk4ViqddJuA%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> >
