[mojo-dev] [jira] (MRPM-174) Add ability to load PGP passphase under settings.xml

[Niels Basjes (JIRA)]

Title: Message Title

Niels Basjes commented on an issue   Re: Add ability to load PGP passphase under settings.xml Hi Dan Tran, As you requested I tested both the gpg and the rpm plugin by compiling them locally and trying to run it against my currect project. My usecase is a project where I need both the jars and rpms to be signed and I currently use the same key to sign both. Also I want to have various signing keys for various different situations So I have to set the correct passphaseServerKey on order to make that possible. I needed to create in the settings this: <server> <id>signingkey</id> <passphrase>{EncyptedStuff=}</passphrase> </server> and <profile> <id>signingkey</id> <properties> <gpg.keyname>12341234</gpg.keyname> <rpm.keyPassphaseServerKey>signingkey</rpm.keyPassphaseServerKey> <gpg.passphaseServerKey>signingkey</gpg.passphaseServerKey> </properties> </profile> Problems I ran into: The server id needed to be gpg.passphase instead of gpg.passphrase (extra 'r') There can be only a single gpg.keyname and yet there are two different gpg.passphaseServerKey and rpm.keyPassphaseServerKey that both must match. So it is impossible to have a different key for the jars and rpms from the settings.xml. Proposal to simplify it all: We remove the serverKey setup completely. GPG plugin has a property gpg.keyname and gpg.passphrase RPM plugin has a property rpm.keyname and rpm.passphrase that default to gpg.keyname and gpg.passphrase. We should remove/deprecate the "Passphrase" setup in the rpm plugin too. Both rpm.passphrase and gpg.passphrase support encrypted and plaintext passwords. So if someone is dumb enough to use the plaintext passwords and turn on debugging you'll see them. Add a warning message that using non-encrypted passwords is a bad setup. In this proposal I can simplify my setup to this: <profile> <id>signingkey</id> <properties> <gpg.keyname>12341234</gpg.keyname> <gpg.passphrase>{EncyptedStuff=}</gpg.passphrase> </properties> </profile> I'm willing to contribute a patch and attach it to Jira if you agree with this proposal. Niels Basjes Add Comment   Mojo's RPM Maven Plugin / MRPM-174 Add ability to load PGP passphase under settings.xml If in for example the ~/.m2/settings.xml the property gpg.keyname has been set then the RPM plugin will pick this up and use it. If gpg.passphrase has been set in the same way then jar files are signed automatically but the rpm plugin will ask for the password during the build. As a workaround I now have this in the configuration settings: {code} <k... This message was sent by Atlassian JIRA (v6.1.6#6162-sha1:7af547c) --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email