grpc
/
grpc-java
mirror of https://github.com/grpc/grpc-java.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix signatures in release process 

We must not include signatures for maven-metadata.xml*, as the file is
a server-maintained index. Avoiding signing the .md5 and .sha1 avoids
signing unnecessary files (which double-excludes some
maven-metadata.xml* files).

We also swap to using ASCII armored output instead of the binary output,
as that's what is appropriate for "asc" files.

Fixes #4574
This commit is contained in:
Eric Anderson 2018-06-20 10:10:59 -07:00
parent 4df4d06f78
commit 3a58a9999e
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
buildscripts/kokoro/upload_artifacts.sh
View File

@ -45,16 +45,18 @@ gpg --version
# This is the version found on kokoro. # This is the version found on kokoro.
if gpg --version | grep 'gpg (GnuPG) 1.'; then if gpg --version | grep 'gpg (GnuPG) 1.'; then
# This command was tested on 1.4.16 # This command was tested on 1.4.16
find "$LOCAL_MVN_ARTIFACTS" -type f -exec \ find "$LOCAL_MVN_ARTIFACTS" -type f \
bash -c 'cat ~/java_signing/passphrase | gpg --batch --passphrase-fd 0 --detach-sign -o {}.asc {}' \; -not -name "maven-metadata.xml*" -not -name "*.sha1" -not -name "*.md5" -exec \
bash -c 'cat ~/java_signing/passphrase | gpg --batch --passphrase-fd 0 --detach-sign -a {}' \;
fi fi
# This is the version found on corp workstations. Maybe kokoro will be updated to gpg2 some day. # This is the version found on corp workstations. Maybe kokoro will be updated to gpg2 some day.
if gpg --version | grep 'gpg (GnuPG) 2.'; then if gpg --version | grep 'gpg (GnuPG) 2.'; then
# This command was tested on 2.2.2 # This command was tested on 2.2.2
find "$LOCAL_MVN_ARTIFACTS" -type f -exec \ find "$LOCAL_MVN_ARTIFACTS" -type f \
-not -name "maven-metadata.xml*" -not -name "*.sha1" -not -name "*.md5" -exec \
gpg --batch --passphrase-file ~/java_signing/passphrase --pinentry-mode loopback \ gpg --batch --passphrase-file ~/java_signing/passphrase --pinentry-mode loopback \
--detach-sign -o {}.asc {} \; --detach-sign -a {} \;
fi fi
STAGING_REPO=a93898609ef848 STAGING_REPO=a93898609ef848