Looking at this line, I'm trying to understand it...
What does this do on the Maven cmd and who is bc ?
-Dgpg.signer=bc
This command generates our release artifacts and signs and notarizes the MacOS package with Apple.
BC stands for "Bouncy Castle", a Java implementation of GPG:
https://maven.apache.org/plugins/maven-gpg-plugin/examples/deploy-signed-artifacts.html#sign-using-bc-signer
2 Likes
Who maintains the GPG_PRIVATE_KEY and PASSPHRASE?
Referencing: https://central.sonatype.org/publish/publish-maven/#gpg-signed-components
I see from the workflow YAML file that it's stored as a variable using GitHub Secrets. Great!
But has the Public Key been uploaded to an OpenPGP keyserver like https://keyserver.ubuntu.com so that it's distributed throughout the OpenPGP synchronising keyserver decentralised network, so folks can verify our files signed with the keys like within Central Repository: org/openrefine/openrefine/3.8.5
We should add this info also to the How to do an OpenRefine version release | OpenRefine
Starting with Maven 3.5.0-beta-1 + , there's now ${revision} and others that are extemely helpful for OSS that publish themselves, especially as libraries as well.
So, I wanted to bring attention to that which was useful for us on DB2Rest project, like OpenRefine it's also a multi-module project that publishes libraries.
The new-ish guide: Maven – Maven CI Friendly Versions shows examples for multi-modules and how we used ${revision} and also used oss for the <flattenMode> in the have to use plugin mentioned in it for deployments Maven Flatten Plugin – flatten:flatten
@tfmorris It made things much simpler for us.