I guess I'm not submitting new versions of my pers...

# announcements

[serebit]

I guess I'm not submitting new versions of my personal libs for a while, given that Maven Central requires signing files, and signing within GitLab CI is just begging for someone to steal the keys. Hopefully someone builds an alternative soon.

[nanodeath]

an alternative to requiring signing artifacts?

[serebit]

An alternative to JCenter.

[nanodeath]

jitpack is about as scrappy as it comes, might be relevant

[Vampire]

JitPack is a real PITA, broken by design and unreliable as hell.
It's not a real alternative to proper publishing.

[ephemient]

gitlab ci supports secrets - variables can only be seen by maintainers

[nanodeath]

I think Campbell was worried about someone hacking GitLab or their hardware

[serebit]

indeed it does, but I'd rather not shove an entire gnupg configuration through an environment variable

[serebit]

Maven signing needs access to the keyring, if I'm not mistaken

[ephemient]

and do what, perform rogue uploads to central? they'd have to hack that too, and you're in the same boat with jcenter/bintray

[serebit]

I can't envision a reasonable way to pack up an entire gnupg configuration, keyring and all, into an environment variable

[serebit]

At least JCenter let me get around that by mirroring to Maven Central and signing the files with their own key, but clearly that isn't an option anymore

[ephemient]

encrypted keyring in storage (aws or whatever), secret api key and passphrase

[ephemient]

or put the whole key into a variable, apparently it fits fine. https://frank.sauerburger.io/2018/07/25/sign-ci-artifacts.html

[serebit]

image.png

[serebit]

https://docs.gradle.org/current/userguide/signing_plugin.html

[ephemient]

right, so just echo "${SECRET_KEY}" | gpg --import before your build like https://gitlab.sauerburger.com/frank/sign-in-ci demonstrates

[serebit]

noted, thanks

[ephemient]

and https://docs.gitlab.com/ee/ci/variables/#protect-a-custom-variable

[serebit]

yeah, i used CI env vars for my bintray key already

[serebit]

this works fine