Comment 1 Alexander Kurtakov 2020-02-18 03:28:27 EST

This is done using  https://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/tree/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh#n139 .
Sravan told me we are using David Williams personal key instead of foundation one. 
This bug is so we figure out how/where to get Eclipse foundation gpg key in the build nodes so we can sign with it. 
Mickael/Fred, can you enlighten us?

Comment 2 Eclipse Genie 2020-02-18 03:35:08 EST

New Gerrit change created: https://git.eclipse.org/r/157877

Comment 3 Eclipse Genie 2020-02-18 03:54:59 EST

Gerrit change https://git.eclipse.org/r/157877 was merged to [master].
Commit: http://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/commit/?id=d3795bb9bb4cafc8cbd1d7b81a5bd8b851b37a8f

Comment 4 Alexander Kurtakov 2020-02-26 15:06:01 EST

Would you please guys give us info how/whether we can use gpg key?

Comment 5 Alexander Kurtakov 2020-03-11 06:38:16 EDT

Any hope for info here?

Comment 6 Mikaël Barbero 2020-03-13 04:15:39 EDT

We can provide you (the releng project) with a gpg key the same way as we do for any project that want to deploy artifacts to maven central (where gpg signing is a prerequisite). 

This can only happen on the new infra (JIRO), so you will have to complete the migration to it first (i.e. https://bugs.eclipse.org/bugs/show_bug.cgi?id=552165 must be resolved).

Once done, you will be able to inject the gpg key in any job gpg keychain following the first two steps from https://wiki.eclipse.org/Jenkins#How_can_artifacts_be_deployed_to_OSSRH_.2F_Maven_Central.3F

For the signing itself, we will add a secret to Jenkins (the gpg private key passphrase) so that you can inject it in your build and sign with the previously added key. We will provide a FAQ entry with the detailed steps. 

AFAICT from the code in https://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/tree/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh#n139, there are 2 different keys used in there (1 for equinox, 1 for "eclipse"). We only provide a single gpg keypair per project (here the releng project) so you will have to adapt the script a bit.

Comment 7 Alexander Kurtakov 2020-10-02 04:59:29 EDT

(In reply to Mikaël Barbero from comment #6)
> We can provide you (the releng project) with a gpg key the same way as we do
> for any project that want to deploy artifacts to maven central (where gpg
> signing is a prerequisite). 
> 
> This can only happen on the new infra (JIRO), so you will have to complete
> the migration to it first (i.e.
> https://bugs.eclipse.org/bugs/show_bug.cgi?id=552165 must be resolved).
> 
> Once done, you will be able to inject the gpg key in any job gpg keychain
> following the first two steps from
> https://wiki.eclipse.org/Jenkins#How_can_artifacts_be_deployed_to_OSSRH_.
> 2F_Maven_Central.3F
> 
> For the signing itself, we will add a secret to Jenkins (the gpg private key
> passphrase) so that you can inject it in your build and sign with the
> previously added key. We will provide a FAQ entry with the detailed steps. 
> 
> AFAICT from the code in
> https://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/
> tree/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/
> produceChecksum.sh#n139, there are 2 different keys used in there (1 for
> equinox, 1 for "eclipse"). We only provide a single gpg keypair per project
> (here the releng project) so you will have to adapt the script a bit.

Now that Releng JIPP is on JIRO can we proceed with this ?

Comment 8 Mikaël Barbero 2020-10-06 09:42:38 EDT

I've added the required credentials along with a test job to demonstrate how to do it (see https://ci.eclipse.org/releng/job/test-gpg-sign/3/console and https://ci.eclipse.org/releng/job/test-gpg-sign/configure)

Comment 9 Sravan Kumar Lakkimsetti 2020-10-08 06:08:34 EDT

(In reply to Mikaël Barbero from comment #8)
> I've added the required credentials along with a test job to demonstrate how
> to do it (see https://ci.eclipse.org/releng/job/test-gpg-sign/3/console and
> https://ci.eclipse.org/releng/job/test-gpg-sign/configure)

I will try it shortly. thank you for your help. Reopening

Comment 10 Eclipse Genie 2020-10-15 10:47:37 EDT

New Gerrit change created: https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/170837

Comment 11 Eclipse Genie 2020-10-15 10:50:03 EDT

Gerrit change https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/170837 was merged to [master].
Commit: http://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/commit/?id=1c14d84f43164576f53f53597bf1ac150a9effed

Comment 12 Eclipse Genie 2020-10-16 00:03:02 EDT

New Gerrit change created: https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/170221

Comment 13 Eclipse Genie 2020-10-16 00:03:46 EDT

Gerrit change https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/170221 was merged to [master].
Commit: http://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/commit/?id=37b25bfa6592df0e2ba10538b7bbb7d0d98ae931

Comment 14 Eclipse Genie 2020-10-27 04:13:18 EDT

New Gerrit change created: https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/171247

Comment 15 Eclipse Genie 2020-10-27 04:17:46 EDT

Gerrit change https://git.eclipse.org/r/c/platform/eclipse.platform.releng.aggregator/+/171247 was merged to [master].
Commit: http://git.eclipse.org/c/platform/eclipse.platform.releng.aggregator.git/commit/?id=6589aab4b5b473ec2f2883ff0673bfb006a05ead