Feature - allow signing to be specified in settings.xml

[adamretter]

This PR takes a feature from jdeb which allows the signing information to be specified in an active profile within ~/.m2/settings.xml.

This makes configuring the plugin for externalising the sensitive signature config options simpler, as custom property names no longer have to be explicitly specified in the pom.xml. Of course you can still specify custom property names if you wish ;-)

Simply adding the following to your your ~/.m2/settings.xml should be enough:

<profiles>

       <profile>
          <id>rpm-signing</id>
          <properties>
            <rpm.keyringFile>/home/me/.gnupg/secring.gpg</rpm.keyringFile>
            <rpm.keyId>AA540227</rpm.keyId>
            <rpm.passphrase>top-secret</rpm.passphrase>
          </properties>
        </profile>

</profiles>


<activeProfiles>

       <activeProfile>rpm-signing</activeProfile>

</activeProfiles>

The rpm. prefix of the property names can be customised through the plugin configuration element signCfgPrefix

[ctron]

Thanks for the PR. This makes total sense. There are a few "style" comments I will add, I hope you don't mind 😀

I am just wondering, should it already be possible to configure the via properties using rpm.signature?

[ctron]

I would prefer to have expanded imports.

[adamretter]

Okay sure. Apologies, my IDE (IntelliJ) insists on doing these automated "improvements" for me.

[ctron]

I would prefer a non-abbreviated name, e.g. signConfigurationPrefix. And wouldn't it make sense to allow the user to set this via properties as well?

[adamretter]

I can certainly do that. I just took the existing syntax from jdeb, but I can update it...

[ctron]

Maybe wrap this section up in another method?

[ctron]

IIRC we are on Java 8. So you can drop the type arguments on the constructor:

Suggested change

	final Map<String, String> map = new HashMap<String, String>();
	final Map<String, String> map = new HashMap<>();

[ctron]

Suggested change

	final Set<String> activeProfiles = new HashSet<String>(activeProfilesList);
	final Set<String> activeProfiles = new HashSet<>(activeProfilesList);

[ctron]

Re-iterating over the PR, wouldn't it be possible to find a solution which doesn't require to manually iterate over the settings and profiles?

[adamretter]

@ctron I did actually try such an approach first but I could not get it to work, which is why we ended up with iterating over the properties.

[adamretter]

@ctron I pushed a commit which I think addresses your comments.

[dwalluck]

The rpm. prefix of the property names can be customised through the plugin configuration element signCfgPrefix

I kind of wonder why it can't use the existing gpg properties (described here) for this (although I understand why you might want different ones).

I guess putting it in settings has transparent support for encrypted passwords?

I don't really see the point in making the prefix configurable as all the other properties using an rpm. prefix and all the properties should use the same prefix by convention.

[ctron]

The rpm. prefix of the property names can be customised through the plugin configuration element signCfgPrefix

I don't really see the point in making the prefix configurable as all the other properties using an rpm. prefix and all the properties should use the same prefix by convention.

I tend to agree here. Making it configurable, may sound nice for some niche use cases, but adds some complexity that I am not sure, is worth it.

I completely understand the use case, but would prefer something that works without manually iterating over the settings.

[ctron]

I did a quick check: Using the properties from MavenProject#getProperties you already have everything expanded. I also checked the maven resources filtering system, they basically take the project properties, overwrite this with the system properties, and then the user properties. I think this should be much simpler, and re-use all that maven does anyway:

@Mojo(name = "sayhi")
public class MyMojo extends AbstractMojo {

    @Parameter(property = "project", readonly = true, required = true)
    private MavenProject project;

    @Parameter(property = "session", readonly = true, required = true)
    private MavenSession session;

    @Override
    public void execute() throws MojoExecutionException {
        Properties p = new Properties();
        p.putAll(project.getProperties());
        p.putAll(session.getSystemProperties());
        p.putAll(session.getUserProperties());
        for ( Map.Entry<?, ?> entry : p.entrySet()) {
            getLog().info(String.format("%-40s: %s", entry.getKey(), entry.getValue()));
        }
    }
}

[lburja]

Any chance for this to be merged? It looks like a nice improvement over configuring signing inside the pom.xml