combust / combust/mleap

Secret for publishing signed jars must be updated

Open
#821 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Scala
Stars
1.5k
Forks
315
PR merge metrics
No merged PRs in 30d

Description

Following the recent [sbt upgrade](https://github.com/combust/mleap/pull/818), the "publish signed jars" step [broke](https://app.travis-ci.com/github/combust/mleap/jobs/575823488) cause it relies on an encrypted file `travis/travis.tar` extracted in `travis/extract.sh` which has some code in it that still relies on the old sbt. We need to either:

- someone with the right key/iv/passphrase to decrypt the file to fix it
- overhaul the publishing mechanism such that we don't keep encrypted secrets in the repo.

I haven't researched how to do the latter (and I may not have the time/resources), but it seems preferable in the long-term and I assume other open sources projects have figured it out.

We won't be able to make a new MLeap release until this is fixed.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading travis/extract.sh and inspecting the encrypted travis/travis.tar used by the “publish signed jars” Travis job, then compare that path with the recent sbt upgrade in PR 818. Done means the publish-signed-jars step succeeds with an updated publishing mechanism or corrected encrypted artifact, allowing a new MLeap release.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala
Domain
build-system, devops, release
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.