Skip to content

Fix sources-jar signing: attach-sources ran after gpg:sign, not before #146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernardladenthin merged 1 commit into from
Jul 15, 2026
Merged

Fix sources-jar signing: attach-sources ran after gpg:sign, not before #146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion srcmorph-cli/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -428,7 +428,20 @@ SPDX-License-Identifier: Apache-2.0
<executions>
<execution>
<id>attach-sources</id>
<phase>verify</phase>
<!--
Must run at package (jar-no-fork's own default phase), NOT verify.
maven-gpg-plugin's sign-artifacts execution (release profile) is bound
to verify; package always runs before verify in the lifecycle, so the
sources jar must be built and attached here to exist before signing
runs. Binding this to verify put it in the SAME phase as gpg:sign,
and — since the parent's inherited gpg execution ran first — gpg
signed only the main jar + javadoc jar + pom, silently omitting the
sources jar. Sonatype Central's deployment validation then rejected
the whole bundle for a missing signature (caught on the first real
release attempt; not visible in any dry run that passed -Dgpg.skip=true,
which also skips the real execution-order interaction).
-->
<phase>package</phase>
<goals>
<goal>jar-no-fork</goal>
</goals>
Expand Down
15 changes: 14 additions & 1 deletion srcmorph-maven-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -531,7 +531,20 @@ SPDX-License-Identifier: Apache-2.0
<executions>
<execution>
<id>attach-sources</id>
<phase>verify</phase>
<!--
Must run at package (jar-no-fork's own default phase), NOT verify.
maven-gpg-plugin's sign-artifacts execution (release profile) is bound
to verify; package always runs before verify in the lifecycle, so the
sources jar must be built and attached here to exist before signing
runs. Binding this to verify put it in the SAME phase as gpg:sign,
and — since the parent's inherited gpg execution ran first — gpg
signed only the main jar + javadoc jar + pom, silently omitting the
sources jar. Sonatype Central's deployment validation then rejected
the whole bundle for a missing signature (caught on the first real
release attempt; not visible in any dry run that passed -Dgpg.skip=true,
which also skips the real execution-order interaction).
-->
<phase>package</phase>
<goals>
<goal>jar-no-fork</goal>
</goals>
Expand Down
15 changes: 14 additions & 1 deletion srcmorph/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,7 +430,20 @@ SPDX-License-Identifier: Apache-2.0
<executions>
<execution>
<id>attach-sources</id>
<phase>verify</phase>
<!--
Must run at package (jar-no-fork's own default phase), NOT verify.
maven-gpg-plugin's sign-artifacts execution (release profile) is bound
to verify; package always runs before verify in the lifecycle, so the
sources jar must be built and attached here to exist before signing
runs. Binding this to verify put it in the SAME phase as gpg:sign,
and — since the parent's inherited gpg execution ran first — gpg
signed only the main jar + javadoc jar + pom, silently omitting the
sources jar. Sonatype Central's deployment validation then rejected
the whole bundle for a missing signature (caught on the first real
release attempt; not visible in any dry run that passed -Dgpg.skip=true,
which also skips the real execution-order interaction).
-->
<phase>package</phase>
<goals>
<goal>jar-no-fork</goal>
</goals>
Expand Down
Loading