module Buildr::GPG

Signs the packages using gpg and uploads signatures as part of the upload process.

Require explicitly using require "buildr/apg". This will result in all packages being signed. The user must specify the GPG_USER environment key to identify the key to use and may specify GPG_PASS if the key needs a password to access. e.g.

$ GPG_USER=user@example.com GPG_PASSWD=secret buildr clean upload

Public Class Methods

sign_and_upload(project, pkg) click to toggle source
# File addon/buildr/gpg.rb, line 57
def sign_and_upload(project, pkg)
  project.task(:upload).enhance do
    artifact = Buildr.artifact(pkg.to_spec_hash.merge(:type => "#{pkg.type}.asc"))
    artifact.from(sign_task(pkg))
    artifact.invoke
    artifact.upload
  end
end
sign_and_upload_all_packages(project) click to toggle source
# File addon/buildr/gpg.rb, line 66
def sign_and_upload_all_packages(project)
  project.packages.each { |pkg| Buildr::GPG.sign_and_upload(project, pkg) }
  project.packages.select {|pkg| pkg.respond_to?(:pom) }.map { |pkg| pkg.pom }.compact.uniq.each { |pom| Buildr::GPG.sign_and_upload(project, pom) }
end
sign_task(pkg) click to toggle source
# File addon/buildr/gpg.rb, line 29
def sign_task(pkg)
  raise "ENV['GPG_USER'] not specified" unless ENV['GPG_USER']
  asc_filename = pkg.to_s + '.asc'
  return if file(asc_filename).prerequisites.include?(pkg.to_s)
  file(asc_filename => [pkg.to_s]) do
    info "GPG signing #{pkg.to_spec}"

    cmd = []
    cmd << 'gpg'
    cmd << '--local-user'
    cmd << ENV['GPG_USER']
    cmd << '--armor'
    cmd << '--output'
    cmd << pkg.to_s + '.asc'
    if ENV['GPG_PASS']
      cmd << '--passphrase'
      cmd << ENV['GPG_PASS']
    end
    cmd << '--detach-sig'
    cmd << '--batch'
    cmd << '--yes'
    cmd << pkg
    trace(cmd.join(' '))
    `#{cmd.join(' ')}`
    raise "Unable to generate signature for #{pkg}" unless File.exist?(asc_filename)
  end
end