Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update publish-plugin to published signed plugin artifacts #295

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

fzhinkin
Copy link
Collaborator

@fzhinkin fzhinkin commented Mar 5, 2025

Updated infra and published plugins to unlock signed plugin artifacts publication.

Closes #115

@fzhinkin
Copy link
Collaborator Author

fzhinkin commented Mar 5, 2025

I tried to test it by changing plugin id and publishing it from my personal account. Obviously, verification on the portal side failed and the submission was rejected, but looking into Gradle's logs it seems like .asc files for plugin were uploaded.

@adam-enko, @Tapchicoma maybe you guys know a better testing approach?

@adam-enko
Copy link
Member

@adam-enko, @Tapchicoma maybe you guys know a better testing approach?

Personally I test publishing by adding a local directory and manually verifying the files.

Example: https://github.com/kotest/kotest/blob/26db26e6275cad3c67e4562aa779c9f00dc01eeb/buildSrc/src/main/kotlin/kotest-publishing-conventions.gradle.kts#L61-L65

@adam-enko
Copy link
Member

Looking at the PR, imho it'd be better to update kotlinx team infra plugin to avoid such workarounds. The last time I looked at the infra plugin it used a lot of non-idiomatic practices that could be refactored to avoid these issues. Is updating the infra plugin feasible?

@fzhinkin
Copy link
Collaborator Author

fzhinkin commented Mar 7, 2025

it'd be better to update kotlinx team infra plugin to avoid such workarounds.

I considered that option, but there's only a few projects still using the plugin and I though it would be easier to update one of them to exclude the duplicated artifact instead of updating all other projects to include it explicitly.

the infra plugin it used a lot of non-idiomatic practices that could be refactored to avoid these issues

It makes sense to do all that at some point and then get rid of the workaround I'm adding here.

@fzhinkin
Copy link
Collaborator Author

fzhinkin commented Mar 7, 2025

Personally I test publishing by adding a local directory and manually verifying the files.

Apparently, signature files are always published to a local repo, no matter what version of publish plugin I'm using :/

@adam-enko
Copy link
Member

I just saw another user posted in the Gradle Slack with the same problem. Possibly there's an issue with the Plugin Portal?

image

https://gradle-community.slack.com/archives/CA745PZHN/p1741602255845399 (archive)

@fzhinkin
Copy link
Collaborator Author

I'll check it, thanks for pointing to it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Artifacts should be signed for dependency verification
2 participants