Maven GPG Plugin – My Shitty Code https://myshittycode.com Embracing the Messiness in Search of Epic Solutions Fri, 06 Jan 2023 16:25:47 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.1 https://myshittycode.com/wp-content/uploads/2022/04/cropped-icon-32x32.png Maven GPG Plugin – My Shitty Code https://myshittycode.com 32 32 205304208 Maven GPG Plugin: Prevent Signing Prompt or “gpg: signing failed: No such file or directory” Error https://myshittycode.com/2017/08/07/maven-gpg-plugin-prevent-signing-prompt-or-gpg-signing-failed-no-such-file-or-directory-error/ https://myshittycode.com/2017/08/07/maven-gpg-plugin-prevent-signing-prompt-or-gpg-signing-failed-no-such-file-or-directory-error/#comments Mon, 07 Aug 2017 20:09:22 +0000 http://myshittycode.com/?p=1056 PROBLEM Given the following Maven settings.xml:- … and the following Maven GPG Plugin configuration in pom.xml:- When running mvn clean deploy, you either get a prompt for you to enter the GPG passphrase:- … or, get the following error:- The long story short, Maven GPG Plugin isn’t using the passphrase defined in the Maven settings.xml… […]

The post Maven GPG Plugin: Prevent Signing Prompt or “gpg: signing failed: No such file or directory” Error appeared first on My Shitty Code.

]]> PROBLEM

Given the following Maven settings.xml:-

<?xml version="1.0"?>
<settings>
	<profiles>
		<profile>
			<activation>
				<activeByDefault>true</activeByDefault>
			</activation>
			<properties>
				<gpg.executable>/usr/local/bin/gpg</gpg.executable>
				<gpg.passphrase>XXXXXXXXXXXXXXXXXX</gpg.passphrase>
			</properties>
		</profile>
	</profiles>
</settings>

… and the following Maven GPG Plugin configuration in pom.xml:-

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-gpg-plugin</artifactId>
    <version>1.6</version>
    <executions>
        <execution>
            <id>sign-artifacts</id>
            <phase>verify</phase>
            <goals>
                <goal>sign</goal>
            </goals>
        </execution>
    </executions>
</plugin>

When running mvn clean deploy, you either get a prompt for you to enter the GPG passphrase:-

┌────────────────────────────────────────────────────────────────┐
│ Please enter the passphrase to unlock the OpenPGP secret key:  │
│ "Shitty Author &lt;shitty@email.com>"                             │
│ 2048-bit RSA key, ID 9F1A27DFE94D5473,                         │
│ created 2015-05-08.                                            │
│                                                                │
│                                                                │
│ Passphrase: __________________________________________________ │
│                                                                │
│         &lt;OK>                                    &lt;Cancel>       │
└────────────────────────────────────────────────────────────────┘

… or, get the following error:-

gpg: signing failed: No such file or directory

The long story short, Maven GPG Plugin isn’t using the passphrase defined in the Maven settings.xml… AND THIS UPSETS THE HONEY BADGER!

SOLUTION

If you 1) initially had it working in the past, and 2) have tried all sorts of solutions from the web, and still couldn’t get it working, chances are you have unconsciously upgraded GPG version from 2.0 to 2.1.

You can check your GPG version by running the following command:-

✗ gpg --version
gpg (GnuPG) 2.1.21
libgcrypt 1.7.6
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later &lt;https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /Users/shitty-author/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

To fix this, GPG 2.1 requires --pinentry-mode to be set to loopback in order to pick up gpg.passphrase value defined in Maven settings.xml.

So, update Maven GPG Plugin configuration in pom.xml to the following:-

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-gpg-plugin</artifactId>
    <version>1.6</version>
    <executions>
        <execution>
            <id>sign-artifacts</id>
            <phase>verify</phase>
            <goals>
                <goal>sign</goal>
            </goals>
            <configuration>
                <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                </gpgArguments>
            </configuration>
        </execution>
    </executions>
</plugin>

When re-running mvn clean deploy, it should deploy the artifact properly now.

The post Maven GPG Plugin: Prevent Signing Prompt or “gpg: signing failed: No such file or directory” Error appeared first on My Shitty Code.

]]> https://myshittycode.com/2017/08/07/maven-gpg-plugin-prevent-signing-prompt-or-gpg-signing-failed-no-such-file-or-directory-error/feed/ 4 1056