-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Gradle plugin: Logic to unregister derived artifacts from a publication is too eager #414
Labels
bug
Something isn't working
Comments
@ljacomet I believe in the weekly, you mentioned you have time to make these adjustments? Can I assign it to you? |
I would suggest moving |
ljacomet
added a commit
to ljacomet/sigstore-java
that referenced
this issue
Apr 6, 2023
This enables having all publications in the same repository, making testing things like the Gradle plugin much easier as a single location needs to be added to a build. Issue sigstore#414
ljacomet
added a commit
to ljacomet/sigstore-java
that referenced
this issue
Apr 6, 2023
Only handle them when they are artifacts sigstore created a signature for. Fixes sigstore#414
ljacomet
added a commit
to ljacomet/sigstore-java
that referenced
this issue
Apr 6, 2023
This enables having all publications in the same repository, making testing things like the Gradle plugin much easier as a single location needs to be added to a build. Issue sigstore#414 Signed-off-by: Louis Jacomet <louis@gradle.com>
ljacomet
added a commit
to ljacomet/sigstore-java
that referenced
this issue
Apr 6, 2023
Only handle them when they are artifacts sigstore created a signature for. Fixes sigstore#414 Signed-off-by: Louis Jacomet <louis@gradle.com>
ljacomet
added a commit
to ljacomet/sigstore-java
that referenced
this issue
Apr 6, 2023
Only handle them when they are artifacts sigstore created a signature for. Fixes sigstore#414 Signed-off-by: Louis Jacomet <louis@gradle.com>
vlsi
pushed a commit
that referenced
this issue
Apr 6, 2023
Only handle them when they are artifacts sigstore created a signature for. Fixes #414 Signed-off-by: Louis Jacomet <louis@gradle.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
When applying the
dev.sigstore.sign
plugin on a project that also applies the Gradle signing plugin,.sigstore
files end up being signed.While fixing this properly requires new APIs in Gradle for both plugins to consume publications, there is a way to disable that by explicitly removing what to sign from the Gradle
Sign
tasks:However doing that results in the following:
Full stack trace
This is caused by the Sigstore Gradle plugin always attempting to configure the Sigstore task:
sigstore-java/sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
Lines 97 to 111 in ec01470
AFAICT the
configure
call and removal should only happen if the artifact removed is indeed the source of a sigstore signature. Sinceasc
files are ignored, when we enter that logic, these actions should not even be attempted.Version
Gradle plugin
dev.sigstore.sign:0.4.0
The text was updated successfully, but these errors were encountered: