Default to use GnuPG (useGpg := true), instead of Bouncy Castle

[eed3si9n]

Ref #140

This defaults useGpg to true, but makes it overridable from system property SBT_PGP_USE_GPG.

[eed3si9n]

@djspiewak @wsargent @jodersky What do you guys think? Even if people move on to sbt-gpg, I am guessing there's still a ton of build that relies on sbt-pgp, so I think it's worth having a soft transition like this. This should encourage people to use gpg + pinentry locally, at least on a local machine.

[djspiewak]

@eed3si9n I strongly agree. I do think sbt-gpg is a nicer solution at this point (no fault of yours or anyone else's!), but people are still using it, and useGpg := true is definitely a vastly safer way of using sbt-pgp than the previous defaults. I also agree with some of your earlier where you note that people relying on the Bouncycastle mode of configuration for CI publication will probably have the hardest time of it. I'm not sure the best way to help such projects, but this PR is a good step in the right direction.

[wsargent]

@eed3si9n I approve, I think gpg can be assumed to exist (like "curl", "zip" etc)

[eed3si9n]

cool. Thanks for the input.

[Atry]

If you are creating an sbt plugin with a boolean setting, you are probably doing something wrong. Instead you may want to split your plugin into two plugins and remove the boolean setting, according to Single Responsibility Principle.

[eed3si9n]

There is in fact a plugin called sbt-gpg, but it's more effective for me to change the default setting here because people are happy to upgrade to 2.0.0 rather than switch to a new plugin.

[Atry]

I guess they would not reinvent sbt-gpg if sbt-pgp is split to two plugins at very beginning.

[djspiewak]

I guess they would not reinvent sbt-gpg if sbt-pgp is split to two plugins at very beginning.

It's worth remembering that sbt-pgp is a very old plugin. I think it's actually the oldest sbt plugin still in common use today, so it's not too surprising that it's a bit out of step with how plugins are designed today. That doesn't make it bad, it just explains why some of its design might seem a bit odd.