Skip to content

Commit 893aedc

Browse files
cstamascstamas
authored
[MGPG-125] Fix "bestPractices" (#95)
As currently due defaulted values it would always fail, unless user explicitly re-configures plugin. So, do not set "default value" on mojo level, instead handle it programmatically, when bestPractices is not set. Added ITs for "bestPractices", one for success and one for failure. --- https://issues.apache.org/jira/browse/MGPG-125
1 parent b6f0324 commit 893aedc

File tree

8 files changed

+314
-7
lines changed

8 files changed

+314
-7
lines changed

‎src/it/sign-release-best-practices-fail/invoker.properties

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
invoker.buildResult = failure

‎src/it/sign-release-best-practices-fail/pom.xml

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!--
4+
Licensed to the Apache Software Foundation (ASF) under one
5+
or more contributor license agreements. See the NOTICE file
6+
distributed with this work for additional information
7+
regarding copyright ownership. The ASF licenses this file
8+
to you under the Apache License, Version 2.0 (the
9+
"License"); you may not use this file except in compliance
10+
with the License. You may obtain a copy of the License at
11+
12+
http://www.apache.org/licenses/LICENSE-2.0
13+
14+
Unless required by applicable law or agreed to in writing,
15+
software distributed under the License is distributed on an
16+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17+
KIND, either express or implied. See the License for the
18+
specific language governing permissions and limitations
19+
under the License.
20+
-->
21+
22+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
23+
<modelVersion>4.0.0</modelVersion>
24+
25+
<groupId>org.apache.maven.its.gpg.sr</groupId>
26+
<artifactId>test</artifactId>
27+
<version>1.0</version>
28+
<packaging>jar</packaging>
29+
30+
<description>
31+
Tests the installation of a simple release JAR with an attached artifact and its signatures.
32+
</description>
33+
34+
<properties>
35+
<maven.test.skip>true</maven.test.skip>
36+
</properties>
37+
38+
<build>
39+
<plugins>
40+
<plugin>
41+
<groupId>org.apache.maven.plugins</groupId>
42+
<artifactId>maven-compiler-plugin</artifactId>
43+
<version>@version.maven-compiler-plugin@</version>
44+
</plugin>
45+
<plugin>
46+
<groupId>org.apache.maven.plugins</groupId>
47+
<artifactId>maven-gpg-plugin</artifactId>
48+
<version>@project.version@</version>
49+
<executions>
50+
<execution>
51+
<id>sign-artifacts</id>
52+
<goals>
53+
<goal>sign</goal>
54+
</goals>
55+
</execution>
56+
</executions>
57+
<configuration>
58+
<bestPractices>true</bestPractices>
59+
<!-- load passphrase from settings.xml -->
60+
<!-- but not the default -->
61+
<passphraseServerId>gpg.passphrase-sign-with-passphase-from-maven-settings</passphraseServerId>
62+
</configuration>
63+
</plugin>
64+
<plugin>
65+
<groupId>org.apache.maven.plugins</groupId>
66+
<artifactId>maven-install-plugin</artifactId>
67+
<version>@version.maven-install-plugin@</version>
68+
</plugin>
69+
<plugin>
70+
<groupId>org.apache.maven.plugins</groupId>
71+
<artifactId>maven-jar-plugin</artifactId>
72+
<version>@version.maven-jar-plugin@</version>
73+
</plugin>
74+
<plugin>
75+
<groupId>org.apache.maven.plugins</groupId>
76+
<artifactId>maven-resources-plugin</artifactId>
77+
<version>@version.maven-resources-plugin@</version>
78+
</plugin>
79+
<plugin>
80+
<groupId>org.apache.maven.plugins</groupId>
81+
<artifactId>maven-source-plugin</artifactId>
82+
<version>@version.maven-source-plugin@</version>
83+
<executions>
84+
<execution>
85+
<id>attach-sources</id>
86+
<goals>
87+
<goal>jar</goal>
88+
</goals>
89+
</execution>
90+
</executions>
91+
</plugin>
92+
<plugin>
93+
<groupId>org.apache.maven.plugins</groupId>
94+
<artifactId>maven-surefire-plugin</artifactId>
95+
<version>@version.maven-surefire@</version>
96+
</plugin>
97+
</plugins>
98+
</build>
99+
100+
</project>

‎src/it/sign-release-best-practices-fail/verify.groovy

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
20+
File buildLog = new File(basedir, "build.log")
21+
String logContent = new File(basedir, "build.log").text
22+
23+
// assert that bestPractice+worstPractice => MojoFailure
24+
assert logContent.contains("MojoFailureException: Do not store passphrase in any file")

‎src/it/sign-release-best-practices/invoker.properties

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
invoker.environmentVariables.MAVEN_GPG_PASSPHRASE = TEST

‎src/it/sign-release-best-practices/pom.xml

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!--
4+
Licensed to the Apache Software Foundation (ASF) under one
5+
or more contributor license agreements. See the NOTICE file
6+
distributed with this work for additional information
7+
regarding copyright ownership. The ASF licenses this file
8+
to you under the Apache License, Version 2.0 (the
9+
"License"); you may not use this file except in compliance
10+
with the License. You may obtain a copy of the License at
11+
12+
http://www.apache.org/licenses/LICENSE-2.0
13+
14+
Unless required by applicable law or agreed to in writing,
15+
software distributed under the License is distributed on an
16+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17+
KIND, either express or implied. See the License for the
18+
specific language governing permissions and limitations
19+
under the License.
20+
-->
21+
22+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
23+
<modelVersion>4.0.0</modelVersion>
24+
25+
<groupId>org.apache.maven.its.gpg.sr</groupId>
26+
<artifactId>test</artifactId>
27+
<version>1.0</version>
28+
<packaging>jar</packaging>
29+
30+
<description>
31+
Tests the installation of a simple release JAR with an attached artifact and its signatures.
32+
</description>
33+
34+
<properties>
35+
<maven.test.skip>true</maven.test.skip>
36+
</properties>
37+
38+
<build>
39+
<plugins>
40+
<plugin>
41+
<groupId>org.apache.maven.plugins</groupId>
42+
<artifactId>maven-compiler-plugin</artifactId>
43+
<version>@version.maven-compiler-plugin@</version>
44+
</plugin>
45+
<plugin>
46+
<groupId>org.apache.maven.plugins</groupId>
47+
<artifactId>maven-gpg-plugin</artifactId>
48+
<version>@project.version@</version>
49+
<executions>
50+
<execution>
51+
<id>sign-artifacts</id>
52+
<goals>
53+
<goal>sign</goal>
54+
</goals>
55+
</execution>
56+
</executions>
57+
<configuration>
58+
<bestPractices>true</bestPractices>
59+
</configuration>
60+
</plugin>
61+
<plugin>
62+
<groupId>org.apache.maven.plugins</groupId>
63+
<artifactId>maven-install-plugin</artifactId>
64+
<version>@version.maven-install-plugin@</version>
65+
</plugin>
66+
<plugin>
67+
<groupId>org.apache.maven.plugins</groupId>
68+
<artifactId>maven-jar-plugin</artifactId>
69+
<version>@version.maven-jar-plugin@</version>
70+
</plugin>
71+
<plugin>
72+
<groupId>org.apache.maven.plugins</groupId>
73+
<artifactId>maven-resources-plugin</artifactId>
74+
<version>@version.maven-resources-plugin@</version>
75+
</plugin>
76+
<plugin>
77+
<groupId>org.apache.maven.plugins</groupId>
78+
<artifactId>maven-source-plugin</artifactId>
79+
<version>@version.maven-source-plugin@</version>
80+
<configuration>
81+
<forceCreation>true</forceCreation>
82+
</configuration>
83+
<executions>
84+
<execution>
85+
<id>attach-sources</id>
86+
<goals>
87+
<goal>jar</goal>
88+
</goals>
89+
</execution>
90+
</executions>
91+
</plugin>
92+
<plugin>
93+
<groupId>org.apache.maven.plugins</groupId>
94+
<artifactId>maven-surefire-plugin</artifactId>
95+
<version>@version.maven-surefire@</version>
96+
</plugin>
97+
</plugins>
98+
</build>
99+
100+
</project>

‎src/it/sign-release-best-practices/verify.groovy

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
var artifactDir = new File(localRepositoryPath, "org/apache/maven/its/gpg/sr/test/1.0")
20+
21+
var expectedFiles = [
22+
"test-1.0.pom",
23+
"test-1.0.pom.asc",
24+
"test-1.0.jar",
25+
"test-1.0.jar.asc",
26+
"test-1.0-sources.jar",
27+
"test-1.0-sources.jar.asc"
28+
]
29+
30+
for (String expectedFile : expectedFiles) {
31+
var file = new File(artifactDir, expectedFile)
32+
33+
println "Checking for existence of $file"
34+
35+
assert file.isFile()
36+
}

‎src/it/sign-release/verify.groovy

+1-3
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,5 @@ for (String expectedFile : expectedFiles) {
3232

3333
println "Checking for existence of $file"
3434

35-
if (!file.isFile()) {
36-
throw new Exception("Missing file $file")
37-
}
35+
assert file.isFile()
3836
}

‎src/main/java/org/apache/maven/plugins/gpg/AbstractGpgMojo.java

+17-4
Original file line numberDiff line numberDiff line change
@@ -131,13 +131,14 @@ public abstract class AbstractGpgMojo extends AbstractMojo {
131131
* Server id to lookup the passphrase under Maven settings. <em>Do not use this parameter, it leaks
132132
* sensitive data. Passphrase should be provided only via gpg-agent or via env variable.
133133
* If parameter {@link #bestPractices} set to {@code true}, plugin fails when this parameter is configured.</em>
134+
* Is programatically defaulted to {@link #GPG_PASSPHRASE}.
134135
*
135136
* @since 1.6
136137
* @deprecated Do not use this configuration, it may leak sensitive information. Rely on gpg-agent or env
137138
* variables instead.
138139
**/
139140
@Deprecated
140-
@Parameter(property = "gpg.passphraseServerId", defaultValue = GPG_PASSPHRASE)
141+
@Parameter(property = "gpg.passphraseServerId")
141142
private String passphraseServerId;
142143

143144
/**
@@ -299,14 +300,26 @@ public final void execute() throws MojoExecutionException, MojoFailureException
299300
// We're skipping the signing stuff
300301
return;
301302
}
302-
if (bestPractices && (isNotBlank(passphrase) || isNotBlank(passphraseServerId))) {
303+
if (bestPractices) {
304+
enforceBestPractices();
305+
} else {
306+
if (!isNotBlank(passphraseServerId)) {
307+
// default it programmatically: this is needed to handle different cases re bestPractices
308+
passphraseServerId = GPG_PASSPHRASE;
309+
}
310+
}
311+
312+
doExecute();
313+
}
314+
315+
protected void enforceBestPractices() throws MojoFailureException {
316+
// if any of those are not blank: meaning user did explicitly configure these
317+
if (isNotBlank(passphrase) || isNotBlank(passphraseServerId)) {
303318
// Stop propagating worst practices: passphrase MUST NOT be in any file on disk
304319
throw new MojoFailureException(
305320
"Do not store passphrase in any file (disk or SCM repository), rely on GnuPG agent or provide passphrase in "
306321
+ passphraseEnvName + " environment variable.");
307322
}
308-
309-
doExecute();
310323
}
311324

312325
protected abstract void doExecute() throws MojoExecutionException, MojoFailureException;

0 commit comments

Comments
 (0)