Sign during build of "eclipse-repository"

[kwin]

I would like to defer signing my JARs to the creation of the repository.
Unfortunately the goal "tycho-p2-repository-plugin:3.0.0:assemble-repository" does both
a) copying the relevant dependencies to the target/repository folder
b) create metadata about the copied artifacts (containing size and checksum)

If I sign the JARs afterwards the calculated size/checksum does obviously no longer match.
Is there any way I can easily integrate JAR signing in the build of the Maven module of packaging "eclipse-repository"?

(I cannot easily do it while building the individual plugins, as signing requires being on a dedicated Jenkins node which should not take the load for building all plugins).

[laeubi]

tycho-p2-repository:fix-artifacts-metadata is most probably what you are searching for.

the steps are as follow:

1. Build your repo as usual
2. Modify it whatever you like
3. use tycho-p2-repository:fix-artifacts-metadata to update (the name fix is a bit bad chosen I think) the size and/or checksums

[kwin]

Great, thanks a lot

[kwin]

I am a bit confused by the default phases:

• assemble-repository is bound to "package" (

  tycho/tycho-p2/tycho-p2-repository-plugin/src/main/java/org/eclipse/tycho/plugins/p2/repository/AssembleRepositoryMojo.java

  Line 63 in d0eccc1

  @Mojo(name = "assemble-repository", defaultPhase = LifecyclePhase.PACKAGE, threadSafe = true)

  )
• fix-artifacts-metadata is bound to "prepare-package" (

  tycho/tycho-p2/tycho-p2-repository-plugin/src/main/java/org/eclipse/tycho/plugins/p2/repository/FixArtifactsMetadataMetadataMojo.java

  Line 38 in d0eccc1

  @Mojo(name = "fix-artifacts-metadata", defaultPhase = LifecyclePhase.PREPARE_PACKAGE, threadSafe = true)

  )

But in the lifecycle binding it is overridden

tycho/tycho-maven-plugin/src/main/resources/META-INF/plexus/components.xml

Line 192 in d0eccc1

org.eclipse.tycho:tycho-p2-repository-plugin:${project.version}:assemble-repository

so that assemble-repository is also executed in prepare-package, so I guess all three steps need to happen in the same phase then:

1. assemble-repository
2. sign jars
3. fix-artifacts-metadata

[laeubi]

As assemble-repository is bind to the default life-cycle the default phase do not really have much of a meaning. The package phase is usually where a zip is created from your repository so you want your sign / fix mojo bound to prepare-package (what will run after default-prepare-package) and then everything should work as desired.

[mickaelistria]

I would like to defer signing my JARs to the creation of the repository.

This is usually a bad idea: the jars in the target/ folder that will be used for testing or be installed in Maven repo (if you sometimes uses mvn install) would then be different from the ones in your p2 repo. While it should be usually not so annoying, it introduce an risk of strange bugs occuring only in some cases and not others and for which troubleshooting can be hard as it requires one to keep in mind or rediscover that the p2 repo and the artifact in usual Maven locations are different, which is not so trivial.

[kwin]

IMHO pretty common for bundles e.g. consumed from Eclipse Orbit and although I agree that having the same binary everywhere would be beneficial, signing is often expensive and therefore cannot be easily done for all artifacts individually.

[mickaelistria]

Have you considered dropping jarsigner in favor of PGP signatures ( https://help.eclipse.org/latest/index.jsp?topic=%2Forg.eclipse.platform.doc.isv%2Fguide%2Fp2_pgp.html ), that allows to keep the same binary with or without signature.