Skip to content

Commit b20f75a

Browse files
niloc132niloc132
authored
Sign created artifacts, document updated processes (#448)
Updates CI to sign all artifacts produced on main or release branches, using a self-signed certificate. These env vars should be flexible enough for a fork that provides its own signing key to be able to sign their own builds in the same way. Also includes documentation updates reflecting new update site and nightly builds. Fixes #446
1 parent 4922615 commit b20f75a

3 files changed

Lines changed: 97 additions & 19 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,31 @@ jobs:
1515
java-version: '17'
1616
distribution: 'adopt'
1717

18-
- name: Build with Maven
18+
- name: If present (and if on a branch that should be released), write the keystore to a file, and note it exists for the next step
19+
#if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
20+
id: keystore
21+
env:
22+
SIGN_KEYSTORE_CONTENTS: ${{ secrets.SIGN_KEYSTORE_CONTENTS }}
23+
run: |
24+
if [ "$SIGN_KEYSTORE_CONTENTS" != '' ]; then
25+
echo "available=true" >> $GITHUB_OUTPUT
26+
echo "$SIGN_KEYSTORE_CONTENTS" | base64 --decode > ${HOME}/key
27+
else
28+
echo "available=false" >> $GITHUB_OUTPUT
29+
fi
30+
31+
- name: Build with maven (sign artifacts)
32+
if: ${{ steps.keystore.outputs.available == 'true' }}
33+
env:
34+
SIGN_STOREPASS: ${{ secrets.SIGN_STOREPASS }}
35+
SIGN_ALIAS: ${{ secrets.SIGN_ALIAS }}
36+
SIGN_KEYPASS: ${{ secrets.SIGN_KEYPASS }}
37+
SIGN_STORETYPE: ${{ secrets.SIGN_STORETYPE }}
38+
SIGN_TSA: http://timestamp.digicert.com/
39+
run: SIGN_KEYSTORE=${HOME}/key mvn --batch-mode --update-snapshots package
40+
41+
- name: Build with maven (no signing)
42+
if: ${{ steps.keystore.outputs.available != 'true' }}
1943
run: mvn --batch-mode --update-snapshots package
2044

2145
- uses: actions/upload-artifact@v3

‎README.md‎

Lines changed: 37 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,6 @@ The Google Cloud Tools team has put a significant amount of effort in helping br
1212

1313
* [Google Cloud Tools](https://cloud.google.com/)
1414

15-
### Sencha
16-
Sencha provides man power to help update the plugin and the build server which automates the build.
17-
18-
[![Sencha GXT](http://cdn.sencha.com/img/gwt-eclipse-plugin-banner.png)](https://www.sencha.com/products/gxt/)
19-
2015
## Not Included
2116
* This plugin does not include the [Google Cloud Tools Eclipse](https://github.com/GoogleCloudPlatform/google-cloud-eclipse) features.
2217

@@ -52,15 +47,29 @@ Install from the Eclipse marketplace.
5247

5348

5449
## Repository
55-
Download the repo in a zip file.
50+
The Eclipse repositories for this plugin.
51+
52+
### Production
53+
Release update site.
54+
55+
* [Eclipse Marketplace entry for the GWT Plugin](https://marketplace.eclipse.org/content/gwt-plugin)
56+
* [Update sites for the GWT Plugin](https://plugins.gwtproject.org/eclipse/gwt-eclipse-plugin/)
5657

57-
* [https://github.com/gwt-plugins/gwt-eclipse-plugin/releases/download/v4.0.0/repository.zip](https://github.com/gwt-plugins/gwt-eclipse-plugin/releases/download/v4.0.0/repository.zip)
58+
### Production Zip
59+
Download the repo in a zip file from the latest release at the
60+
[releases page](https://github.com/gwt-plugins/gwt-eclipse-plugin/releases/). The current release is
61+
[4.0.0](https://github.com/gwt-plugins/gwt-eclipse-plugin/releases/download/v4.0.0/repository.zip)
5862

63+
### Staging
64+
The staging repository is also at plugins.gwtproject.org, under the `nightly` version. At this time,
65+
these are signed with a self-signed certificate.
5966

60-
## Development
67+
* Nightly update site: https://plugins.gwtproject.org/eclipse/gwt-eclipse-plugin/nightly
68+
69+
## Development
6170

6271
### Importing
63-
Simply use Maven to import all the plugins and modules.
72+
Simply use Maven to import all the plugins and modules.
6473

6574
* Use Eclipse Import and choose import with Existing Maven projects. Don't forget to select recursive import.
6675
* Select all the projects and import them. This will create the .project, .classpath and .settings files. If some exist, they will be overwritten.
@@ -73,16 +82,27 @@ The target defintion build is based off of the Google Cloud Tools. Follow their
7382
* Note: The targets will have to be updated by setting the targets. This will regenerate the Eclipse target files.
7483

7584
### Build
76-
Sencha has provided an internal build agent to build.
77-
[Sencha Eclipse Build](https://teamcity.sencha.com/viewType.html?buildTypeId=Gxt3_Gwt_GwtEclipsePlugin)
78-
79-
* `mvn clean install`
85+
To build, Apache Maven and Java 17 are required. Invoke `mvn verify` to build and test. The resulting
86+
update site can be found in `repo/target/repository` for local deployment and testing.
87+
88+
### Release
89+
Creating a release requires signing artifacts. Set the following environment variables before running
90+
`mvn verify`:
91+
* `SIGN_KEYSTORE` - Path to a pkcs12 keystore that contains a key to use to sign this release
92+
* `SIGN_STOREPASS` - Passphrase for the keystore
93+
* `SIGN_ALIAS` - Alias of the key to use to sign the release
94+
* `SIGN_KEYPASS` - Passphrase for the key
95+
* `SIGN_TSA` - URL of a Time stamp authority to use to sign this release
96+
97+
At this time, releases are performed manually. The releases deployed to the marketplace will be signed
98+
with the certificate for `plugins.gwtproject.org`.
8099

81100
### Deploy
82-
Google storage write permissions are needed to deploy.
83-
84-
* `sh ./build-deploy-release.sh` - deploy production version
85-
* `sh ./build-deploy-snapshot.sh` - deploy snapshot version
101+
Releases are uploaded as zips to the [release](https://github.com/gwt-plugins/gwt-eclipse-plugin/releases/)
102+
part of the Github project page, and also deployed at
103+
https://plugins.gwtproject.org/eclipse/gwt-eclipse-plugin as Eclipse update sites. Releases will be
104+
added to the [GWT-Plugin](https://marketplace.eclipse.org/content/gwt-plugin) page on the Eclipse
105+
Marketplace.
86106

87107
### Testing
88108
There are a couple of archetypes that are used to test.

‎pom.xml‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,41 @@
294294
<module>eclipse/ide-target-platform</module>
295295
</modules>
296296
</profile>
297-
297+
<profile>
298+
<!-- We only sign the jars when the keystore has been provided in the environment -->
299+
<id>sign-jars</id>
300+
<activation>
301+
<file>
302+
<exists>${env.SIGN_KEYSTORE}</exists>
303+
</file>
304+
</activation>
305+
<build>
306+
<plugins>
307+
<plugin>
308+
<groupId>org.apache.maven.plugins</groupId>
309+
<artifactId>maven-jarsigner-plugin</artifactId>
310+
<version>3.0.0</version>
311+
<configuration>
312+
<keystore>${env.SIGN_KEYSTORE}</keystore>
313+
<storepass>${env.SIGN_STOREPASS}</storepass>
314+
<alias>${env.SIGN_ALIAS}</alias>
315+
<keypass>${env.SIGN_KEYPASS}</keypass>
316+
<storetype>${env.SIGN_STORETYPE}</storetype>
317+
<tsa>${env.SIGN_TSA}</tsa>
318+
<verbose>true</verbose>
319+
</configuration>
320+
<executions>
321+
<execution>
322+
<id>sign</id>
323+
<goals>
324+
<goal>sign</goal>
325+
</goals>
326+
</execution>
327+
</executions>
328+
</plugin>
329+
</plugins>
330+
</build>
331+
</profile>
298332
<profile>
299333
<id>teamcity</id>
300334
<properties>

0 commit comments

Comments
 (0)