第54章 署名プラグイン

To use the Signing plugin, include the following in your build script:

署名プラグインを使うには、以下の行をビルドスクリプトに追加します。

apply plugin: 'signing'

In order to create PGP signatures, you will need a key pair (instructions on creating a key pair using the GnuPG tools can be found in the GnuPG HOWTOs). You need to provide the signing plugin with your key information, which means three things:

PGP署名を作成するには、キーペアが必要です(GnuPGツールを使用してキーペアを作成する手順については、GnuPGのHOWTO文書で見つけることができます)。 署名プラグインでは、このキー情報、つまり以下の三つの情報を設定することができます。

These items must be supplied as the values of properties signing.keyId, signing.secretKeyRingFile, and signing.password respectively. Given the personal and private nature of these values, a good practice is to store them in the user gradle.properties file (described in 「GradleプロパティとシステムプロパティGradle properties and system properties」).

これらの情報は、それぞれsigning.keyId、signing.secretKeyRingFile、signing.passwordというプロジェクトプロパティで設定する必要があります。 良いプラクティスは、ユーザーのgradle.propertiesファイル(「GradleプロパティとシステムプロパティGradle properties and system properties」で解説されています)にこれらを保存することです。

signing.keyId=24875D73
signing.password=secret
signing.secretKeyRingFile=/Users/me/.gnupg/secring.gpg

If specifying this information in the user gradle.properties file is not feasible for your environment, you can source the information however you need to and set the project properties manually.

これらの情報をgradle.propertiesファイルで設定するのが環境の問題で難しい場合は、手動でプロジェクトのプロパティに設定させることも可能です。

import org.gradle.plugins.signing.Sign

gradle.taskGraph.whenReady { taskGraph ->
    if (taskGraph.allTasks.any { it instanceof Sign }) {
        // Use Java 6's console to read from the console (no good for
        // a CI environment)
        Console console = System.console()
        console.printf "\n\nWe have to sign some things in this build." +
                       "\n\nPlease enter your signing details.\n\n"

        def id = console.readLine("PGP Key Id: ")
        def file = console.readLine("PGP Secret Key Ring File (absolute path): ")
        def password = console.readPassword("PGP Private Key Password: ")

        allprojects { ext."signing.keyId" = id }
        allprojects { ext."signing.secretKeyRingFile" = file }
        allprojects { ext."signing.password" = password }

        console.printf "\nThanks.\n\n"
    }
}

As well as configuring how things are to be signed (i.e. the signatory configuration), you must also specify what is to be signed. The Signing plugin provides a DSL that allows you to specify the tasks and/or configurations that should be signed.

どのように署名するか(つまり署名者情報の指定)だけでなく、何を署名するかというのも設定しなければなりません。 署名プラグインは、署名すべきタスクやコンフィギュレーションを指定するためのDSLを提供しています。

signing {
    sign configurations.archives
}

> gradle signArchives
:compileJava
:processResources
:classes
:jar
:signArchives

BUILD SUCCESSFUL

Total time: 1 secs

task stuffZip (type: Zip) {
    baseName = "stuff"
    from "src/stuff"
}

signing {
    sign stuffZip
}

> gradle signStuffZip
:stuffZip
:signStuffZip

BUILD SUCCESSFUL

Total time: 1 secs

version = '1.0-SNAPSHOT'
ext.isReleaseVersion = !version.endsWith("SNAPSHOT")

signing {
    required { isReleaseVersion && gradle.taskGraph.hasTask("uploadArchives") }
    sign configurations.archives
}

When specifying what is to be signed via the Signing DSL, the resultant signature artifacts are automatically added to the signatures and archives dependency configurations. This means that if you want to upload your signatures to your distribution repository along with the artifacts you simply execute the uploadArchives task as normal.

署名DSLで署名対象を指定すると、生成された署名は自動的にsignaturesコンフィギュレーションとarchivesコンフィギュレーションに追加されます。 つまり、署名をアーティファクトと一緒に配布用リポジトリに公開したい場合は、通常通りただuploadArchivesタスクを実行すればいいということです。

When deploying signatures for your artifacts to a Maven repository, you will also want to sign the published POM file. The signing plugin adds a signing.signPom() (see: SigningExtension.signPom()) method that can be used in the beforeDeployment() block in your upload task configuration.

uploadArchives {
    repositories {
        mavenDeployer {
            beforeDeployment { MavenDeployment deployment -> signing.signPom(deployment) }
        }
    }
}

When signing is not required and the POM cannot be signed due to insufficient configuration (i.e. no credentials for signing) then the signPom() method will silently do nothing.