使用maven-publish插件签名POM文件

问题描述

我尝试使用maven-publish插件将工件上传到Nexus。 几乎一切顺利，只有一个我找不到解决方案的问题：生成的POM文件未签名。

这是我的代码段：

plugins {
    maven
    `maven-publish`
    id("signing")
    id("org.jetbrains.dokka") version "1.4.10.2"
}

repositories {
    mavenCentral()
}


group = "my.group"
version = "1.0.0"


tasks {
    val sourcesJar by creating(Jar::class) {
        archiveClassifier.set("sources")
        from(sourceSets.main.get().allSource)
    }

    val javadocJar by creating(Jar::class) {
        dependsOn.add(dokkaJavadoc)
        archiveClassifier.set("javadoc")
        from(dokkaJavadoc)
    }

    artifacts {
        archives(sourcesJar)
        archives(javadocJar)
        archives(jar)
    }
}


@Suppress("UnstableApiUsage")
signing {
    useGpgCmd()
    sign(configurations.archives.get())
}




@Suppress("UnstableApiUsage")
publishing {
    repositories {
        maven {
            val releasesRepoUrl = "https://oss.sonatype.org/service/local/staging/deploy/maven2/"
            val snapshotsRepoUrl = "https://oss.sonatype.org/service/local/staging/deploy/snapshots/"
            url = uri(if (version.toString().endsWith("SNAPSHOT")) snapshotsRepoUrl else releasesRepoUrl)
            credentials {
                username=project.properties["ossrhUser"].toString()
                password=project.properties["ossrhPassword"].toString()
            }
        }
    }
    publications {
        create<MavenPublication>("maven") {
            groupId = "my.group"
            artifactId = "my-lib"
            version = "1.0.0"

            pom {
                name.set("my-lib")
                description.set("desc")
                url.set("...")

                licenses {
                    license {
                        name.set("The Apache License,Version 2.0")
                        url.set("http://www.apache.org/licenses/LICENSE-2.0.txt")
                    }
                }
                developers {
                    developer {
                        id.set("Balage1551")
                        name.set("Balazs Vissy")
                        email.set("...")
                    }
                }
                scm {
                    connection.set("...")
                    developerConnection.set("...")
                    url.set("...")
                }
            }

        }
    }
}

当我运行publish时，一切顺利，已签名的jars已上传，但验证失败，缺少用于POM的ASC文件。

更早的时候，在gradle 4中，当我使用maven和Groovy时，我能够添加到我的代码中：

beforeDeployment { Mavendeployment deployment -> signing.signPom(deployment) }

执行我的uploadArchives任务。

如何使用Kotlin DSL和发布结构来做到这一点？

解决方法

这不是一个完整的答案，因为它不能回答我的原始问题，但这是一个可行的解决方法。我切换回maven并使用了Upload任务：

    named<Upload>("uploadArchives") {
        val releasesRepoUrl = "https://oss.sonatype.org/service/local/staging/deploy/maven2/"
        val snapshotsRepoUrl = "https://oss.sonatype.org/service/local/staging/deploy/snapshots/"
        val ossrhUser = project.ext.properties["ossrhUser"].toString()
        val ossrhPassword = project.ext.properties["ossrhPassword"].toString()

        repositories {

            withConvention(MavenRepositoryHandlerConvention::class) {
                mavenDeployer {
                    beforeDeployment {
                        signing.signPom(this)
                    }

                    withGroovyBuilder {
                        "repository"("url" to releasesRepoUrl) {
                            "authentication"("userName" to ossrhUser,"password" to ossrhPassword)
                        }
                        "snapshotRepository"("url" to snapshotsRepoUrl) {
                            "authentication"("userName" to ossrhUser,"password" to ossrhPassword)
                        }
                    }

                    pom.project {
                        withGroovyBuilder {
                           // building up POM in groovy way,awful,but works
                        }
                    }
                }
            }
        }

,

Gradle Maven发布插件页面的示例8应该包含一个解决方案：https://docs.gradle.org/current/userguide/publishing_maven.html

您应该使用sign(configurations.archives.get())而不是sign(publishing.publications["maven"])。