jodersky / sbt-gpg

Simple and secure artifact signing for sbt.
Other
50 stars 3 forks source link

Singning additional artifacts #1

Closed luben closed 6 years ago

luben commented 6 years ago

Hi,

Thank you for the plugin, it works way better for me than the official one.

Is there a way to sign an additional artifact I am publishing?

In my build.sbt I have:

...
val aarTask = taskKey[File]("aar Task")
aarTask := {
  file(s"target/${name.value}-${version.value}.aar")
}
addArtifact( Artifact(nameValue, "aar", "aar"), aarTask )

but it does not sings the aar package (I am building it with gradle). Currently I have similar definition for the the signature that I generate manually, but it would be great if it can be signed automatically when published with the rest of the artifacts.

Regards, luben

jodersky commented 6 years ago

sorry for the late response, I somehow wasn't subscribed to the issue feed. I suspect it has something to do with the order in which plugins are loaded: presumably the plugin first adds signed artifacts and then your settings take effect. I'll check out what can be done.

jodersky commented 6 years ago

After running some tests, it seems it is as I suspected: the plugin gets initialized before project settings and hence will only add signatures to the default artifacts. The solution would be to initialize the plugin after applying user settings, however that is currently not possible with sbt's AutoPlugin abstraction. The issue is being tracked here https://github.com/sbt/sbt/issues/2533. That being said, there is a workaround! Instead of using the autoplugin, manually include its settings in your build definition. I.e. modify the above snippet to be "sandwiched" in between plugin disabling and manual application:

disablePlugins(SbtGpg)
addArtifact(Artifact("root", "aar", "aar"), aarTask)
SbtGpg.projectSettings
luben commented 6 years ago

Thanks, the proposed solution works for me.