63

I'm using Travis-CI to provide continuous integration builds for a few Java open source projects I'm working on.

Normally this works smoothly, but I have a problem when the POM specifies GPG signing, e.g.

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-gpg-plugin</artifactId>
  <version>1.4</version>
  <executions>
    <execution>
      <id>sign-artifacts</id>
      <phase>verify</phase>
      <goals>
        <goal>sign</goal>
      </goals>
    </execution>
  </executions>
</plugin>

This causes the Travis build to fail - apparently because it does not have a passphrase available while running mvn install. See this build for an example.

What is the best way to configure Maven and/or Travis to skip GPG signing for CI test builds, but still perform GPG signing when I do a proper release build?

0

3 Answers 3

107

Disable GPG signing by adding the following line to your .travis.yml file:

install: mvn install -DskipTests -Dgpg.skip

Example: https://github.com/stefanbirkner/system-rules/blob/master/.travis.yml

7
  • I was getting weird gpg errors with Maven and msysgit. Your answer helped me. Thanks Commented Oct 16, 2013 at 3:37
  • 7
    Note that adding skipTests for a CI build may not be the best idea. Commented Apr 24, 2014 at 22:19
  • 7
    In general you're right, but not here ;-) See: docs.travis-ci.com/user/languages/java Commented Apr 24, 2014 at 22:24
  • 1
    Am trying to use -Dgpg.skip=true in my maven release build under jenkins. It seems to have no effect . Any ideas? Commented Aug 17, 2015 at 18:02
  • 3
    The install script is only a preparation for executing the build command. The build command will not skip the tests. For more details please read the documentation of Travis CI. It provides a good explanation that I would not like to repeat. Commented Mar 21, 2017 at 7:03
30

You need to create a profile & make sure you run that only when you do the release build.

Remove the current plugin, and add it in a profile like this:

<profiles>
    <profile>
        <id>release-sign-artifacts</id>
        <activation>
            <property>
                <name>performRelease</name>
                <value>true</value>
            </property>
        </activation>
        <build>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-gpg-plugin</artifactId>
                    <version>1.4</version>
                    <executions>
                        <execution>
                            <id>sign-artifacts</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>sign</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </build>
    </profile>
</profiles>

And then when you actually need to do a release, add the property to your mvn command:

mvn -DperformRelease=true ...
2
  • 2
    Assuming you're using the release plugin: instead of using an activation via the flag you could just add that profile to the releaseProfiles plugin setting.
    – ankon
    Commented Aug 13, 2015 at 16:19
  • 1
    Alternatively you can make the activation property name ${env.TRAVIS} with a value of true. This is because Travis-CI containers are spun-up with various built-in environmental variables (including for example TRAVIS=true and CI=true) and Maven can detect them via the maven syntax for environmental variables ${env.<variable>}. This approach has the benefit of not requiring you to add a system property to every Maven command, but still allowing you to mock activation of the profile and have automatic activation of the profile during the CI build. Commented Dec 16, 2016 at 8:21
13

I found a slightly simpler way to do it with the profile as described above. Instead of using a new property value, you can use the gpg.passphrase property which will need to be provided anyway when doing signing. The modified property section is as follows:

<activation>
    <property>
        <name>gpg.passphrase</name>
    </property>
</activation>

Notice, that no value is required since you want this profile to activate if any value is set for that property.

The corresponding command line then looks like this:

mvn <command> -Dgpg.passphrase=myverysupersecretpassphrase

You can test this out by running it the following two ways:

mvn install

No signed artifacts get generated, and:

mvn install -Dgpg.passphrase=myverysupersecretpassphrase

Signed artifacts get created.

To do the actual signed release of the artifacts do the following:

mvn release:perform -Darguments=-Dgpg.passphrase=myverysupersecretpassphrase

The indirection is needed for the release action because it doesn't propagate the command line arguments directly to the spawned process (see http://maven.apache.org/plugins/maven-gpg-plugin/usage.html).

1
  • 3
    I'd strongly recommend against this approach if you're using a shell that saves command history, as you probably don't want your GPG passphrase floating around in your ~/.bash_history file or whatever. (FYI: The only shell I know of these days that doesn't save history is a regular DOS command prompt.) Commented Feb 12, 2018 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.