Gradle Signing for Dummies

Setup

Windows

Download the GnuPG binary release for windows current version from the official site and install it.

Linux

Grab the latest gpg from your package manager if it's not installed already anyway ;)

Making & exporting a keyring to use with gradle signing

Open a command prompt and run gpg --gen-key this will guide you through the creation of your first keypair. Make sure to enter a secure passphrase which you can remember!

Since GPG 2.1* the only fileformat supported by the Gradle Signing plugin is no longer used by default for GPG, to get around that we export the keypair we just created to the old format.

Again open a command prompt and figure out the keyid for your keypair by running:

gpg --list-key

Example output:

gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2019-06-17
C:/Users/phit/AppData/Roaming/gnupg/pubring.kbx
-----------------------------------------------
pub   rsa2048 2017-06-17 [SC] [expires: 2019-06-17]
      77273D57FA5140E5A91905087A1B92B81840D019
uid           [ultimate] [email protected]
sub   rsa2048 2017-06-17 [E] [expires: 2019-06-17]

In this case we only have one key, 77273D57FA5140E5A91905087A1B92B81840D019 or short* 1840D019 which is basically just the last 8 characters of the long ID.

Run this command to export a keyring in the format needed for gradle singning, replace the XXXXXXXX with your keyid. You will have to enter your passphrase for this.

gpg --export-secret-key XXXXXXXX > %UserProfile%/Desktop/secring.gpg

This will create a file on your Desktop called secring.gpg, hang on to it this is the file we need for Gradle.

Configuring automatic signing after building

build.gradle

First we need to add the signing plugin, to the gradle plugin list at the top just add id 'signing' like so:

plugins {
    id 'java'
    id 'idea'
    id 'signing'
    id 'org.spongepowered.plugin' version '0.6'
}

Then add this at the very bottom of your build.gradle

signing {
    if (project.hasProperty('signing.keyId') && project.hasProperty('signing.password') && project.hasProperty('signing.secretKeyRingFile')) {
        sign configurations.archives
        
        /* Uncomment this if you use shadow in your build process */
        // sign configurations.shadow
    }
}

The if clause makes sure to only run the signing if you have defined the necessary properties for your project, also note the commented out area about using the shadow plugin.

gradle.properties

Note: Do not share your gradle.properties or secring.gpg on git(hub) or with anyone else!

Since we don't want the passphrase to be part of your normal gradle config, you have to create a gradle.properties with the following values, KeyID in short (see above if you forgot how to get that one), your passphrase and the path to your secring.gpg. In the end it should look like this:

signing.keyId=XXXXXXXX
signing.password=mypassword
signing.secretKeyRingFile=path/to/secring.gpg

That's it now if you run your normal build, all jars will be automatically signed and you will find an additional asc file in your build output directory.

If you have any question, you can reach me on discord at phit#4970.

typelogic/gradlesigning.md