Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feature request - do not fail on missing signatures in the same project / reactor build order #29

Closed
Kortanul opened this issue Nov 14, 2017 · 0 comments
Closed

feature request - do not fail on missing signatures in the same project / reactor build order #29

Kortanul opened this issue Nov 14, 2017 · 0 comments
Labels
enhancement New feature or request.
Milestone
v1.3.0

Comments

@Kortanul
Copy link
Contributor

currently, pgpverify checks signatures on all dependencies, even if those dependencies come from the same project as the one being built. that works well if the project is always signed when it is being built, but that makes local development inconvenient.

here's an example scenario where this is a problem:

  • multi-module project A has modules B and C.
  • module C depends on module B.
  • a published version of all modules exists in the Maven repository.
  • the project uses pgpverify to fail the build when signatures are missing or incorrect.

in this scenario, running mvn clean install will cause a failure upon reaching module C because the locally-installed version of module B is not signed with the same signature as the one in the Maven repository.

perhaps there could be an option to disregard dependencies produced by the same multi-module project.
@Kortanul Kortanul mentioned this issue Nov 14, 2017
Closed
@slawekjaranowski slawekjaranowski added the enhancement New feature or request. label Nov 14, 2017
Kortanul added a commit to WrenSecurity/wrensec-deploy-tool that referenced this issue Mar 10, 2018
@Kortanul
Fix prompting for GPG passphrase when compiling
4e1b751 
Without a GPG signature being added during a local compile, the build will fail on dependencies within the current reactor because of:
s4u/pgpverify-maven-plugin#29
@Kortanul Kortanul mentioned this issue Mar 12, 2018
Closed
Kortanul added a commit to Kortanul/pgpverify-maven-plugin that referenced this issue May 24, 2018
@Kortanul
Don't Verify Reactor Deps by Default (s4u#29)
484c8e2 
this change adjusts PGP Verify to no longer complain about dependencies that are being built as part of the current multi-module build, in the event that the current build is not being signed. this allows `mvn clean install` to work properly without requiring that every build be signed, as long as the dependencies of all of the projects in the current build (minus the projects currently being built) are signed. the option can be toggled on or off with the new `verifyReactorDependencies` setting on the plug-in, in the event that projects want to require signing for both dependencies AND projects in the current reactor build.
@Kortanul Kortanul mentioned this issue May 24, 2018
Merged
Kortanul added a commit to Kortanul/pgpverify-maven-plugin that referenced this issue May 24, 2018
@Kortanul
Don't Verify Reactor Deps by Default (s4u#29)
7ff9468 
this change adjusts PGP Verify to no longer complain about dependencies that are being built as part of the current multi-module build, in the event that the current build is not being signed. this allows `mvn clean install` to work properly without requiring that every build be signed, as long as the dependencies of all of the projects in the current build (minus the projects currently being built) are signed. the option can be toggled on or off with the new `verifyReactorDependencies` setting on the plug-in, in the event that projects want to require signing for both dependencies AND projects in the current reactor build.
Kortanul added a commit to Kortanul/pgpverify-maven-plugin that referenced this issue May 24, 2018
@Kortanul
Don't Verify Reactor Deps by Default (s4u#29)
3a6ec64 
this change adjusts PGP Verify to no longer complain about dependencies that are being built as part of the current multi-module build, in the event that the current build is not being signed. this allows `mvn clean install` to work properly without requiring that every build be signed, as long as the dependencies of all of the projects in the current build (minus the projects currently being built) are signed. the option can be toggled on or off with the new `verifyReactorDependencies` setting on the plug-in, in the event that projects want to require signing for both dependencies AND projects in the current reactor build.
Kortanul added a commit to Kortanul/pgpverify-maven-plugin that referenced this issue May 24, 2018
@Kortanul
Don't Verify Reactor Deps by Default (s4u#29)
122f494 
this change adjusts PGP Verify to no longer complain about dependencies that are being built as part of the current multi-module build, in the event that the current build is not being signed. this allows `mvn clean install` to work properly without requiring that every build be signed, as long as the dependencies of all of the projects in the current build (minus the projects currently being built) are signed. the option can be toggled on or off with the new `verifyReactorDependencies` setting on the plug-in, in the event that projects want to require signing for both dependencies AND projects in the current reactor build.
slawekjaranowski pushed a commit that referenced this issue May 24, 2018
@Kortanul @slawekjaranowski
Don't Verify Reactor Deps by Default (#29)
e467ef3 
this change adjusts PGP Verify to no longer complain about dependencies that are being built as part of the current multi-module build, in the event that the current build is not being signed. this allows `mvn clean install` to work properly without requiring that every build be signed, as long as the dependencies of all of the projects in the current build (minus the projects currently being built) are signed. the option can be toggled on or off with the new `verifyReactorDependencies` setting on the plug-in, in the event that projects want to require signing for both dependencies AND projects in the current reactor build.
@slawekjaranowski slawekjaranowski added this to the v1.3.0 milestone Nov 6, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request.
Milestone
v1.3.0
Development

No branches or pull requests
2 participants
@slawekjaranowski @Kortanul