Revert "Use sigstore to sign the artifacts (#72)" (#80)

This reverts commit 70fc56e.

Revert "Use JVM 21 for Gradle (#73)"

This reverts commit c3aba95.

Revert "Use JVM 21 for SigstoreSigning tasks (#74)"

This reverts commit be43da4.

Revert "Add the distributionManagement back to the pom (#75)"

This reverts commit acf894a.

Revert "Upload attestations to GitHub (#76)"

This reverts commit 02d6147.

Revert "Add debug logging (#77)"

This reverts commit 2bc729d.

Revert "Expose logging at info level (#78)"

This reverts commit 7939530.

Revert "Simplify the bundle creation (#79)"

This reverts commit 2d98807.

.github/workflows/release.yml

@@ -14,8 +14,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
-      attestations: write
 
     env:
       GRADLE_OPTS: -Dorg.gradle.caching=true
@@ -30,7 +28,9 @@ jobs:
           java-version: 21
       - uses: gradle/actions/setup-gradle@v4
       - name: Release maven artifacts
-        run: ./gradlew -Pversion=$version publish uploadSignaturesToGitHub
+        run: ./gradlew -Pversion=$version publish
         env:
           ORG_GRADLE_PROJECT_GitHubPackagesUsername: ${{ github.actor }}
           ORG_GRADLE_PROJECT_GitHubPackagesPassword: ${{ github.token }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNING_PRIVATE_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}

gradle.properties

@@ -4,5 +4,5 @@ org.gradle.parallel=true
 org.gradle.jvmargs=-Xmx2048m
 org.gradle.configuration-cache=true
 org.gradle.configureondemand=true
-org.gradle.unsafe.isolated-projects=false
+org.gradle.unsafe.isolated-projects=true
 group=io.github.hfhbd.adventofcode

gradle/build-logic/build.gradle.kts

@@ -4,9 +4,6 @@ plugins {
 
 dependencies {
     implementation(libs.plugins.kotlin.jvm.dep)
-    implementation(libs.plugins.sigstore.dep)
-    implementation(libs.ktor.client.cio)
-    implementation(libs.ktor.client.logging)
 }
 
 val Provider<PluginDependency>.dep: Provider<String> get() = map { "${it.pluginId}:${it.pluginId}.gradle.plugin:${it.version}" }

gradle/build-logic/settings.gradle.kts

@@ -2,7 +2,6 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         mavenCentral()
-        gradlePluginPortal()
     }
     versionCatalogs.register("libs") {
         from(files("../libs.versions.toml"))

gradle/build-logic/src/main/kotlin/setup.gradle.kts

@@ -1,10 +1,7 @@
-import dev.sigstore.sign.tasks.SigstoreSignFilesTask
-
 plugins {
     kotlin("jvm")
     id("maven-publish")
     id("signing")
-    id("dev.sigstore.sign")
 }
 
 kotlin.jvmToolchain(8)
@@ -42,21 +39,17 @@ java {
     withSourcesJar()
 }
 
+signing {
+    val signingKey = providers.gradleProperty("signingKey")
+    if (signingKey.isPresent) {
+        useInMemoryPgpKeys(signingKey.get(), providers.gradleProperty("signingPassword").get())
+        sign(publishing.publications)
+    }
+}
+
 tasks.withType<AbstractArchiveTask>().configureEach {
     isPreserveFileTimestamps = false
     isReproducibleFileOrder = true
     filePermissions {}
     dirPermissions {}
 }
-
-tasks.withType(SigstoreSignFilesTask::class).configureEach {
-    launcher.set(javaToolchains.launcherFor {
-        languageVersion.set(JavaLanguageVersion.of(21))
-    })
-}
-
-tasks.register("uploadSignaturesToGitHub", UploadSignatures::class) {
-    signatures.from(tasks.withType(SigstoreSignFilesTask::class))
-    githubApiUrl = providers.environmentVariable("GITHUB_API_URL")
-    githubRepository = providers.environmentVariable("GITHUB_REPOSITORY")
-}

gradle/libs.versions.toml

@@ -1,11 +1,5 @@
 [versions]
 kotlin = "2.1.0-Beta1"
-ktor = "2.3.12"
-
-[libraries]
-ktor-client-cio = { module = "io.ktor:ktor-client-cio", version.ref = "ktor" }
-ktor-client-logging = { module = "io.ktor:ktor-client-logging", version.ref = "ktor" }
 
 [plugins]
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
-sigstore = { id = "dev.sigstore.sign", version = "1.0.0" }