node-gradle / node-gradle/gradle-node-plugin
Sign plugin releases with PGP
Nobody has claimed this yet.
- Dominant language
- Groovy
- Stars
- 677
- Forks
- 120
- PR merge metrics
- No merged PRs in 30d
Description
Currently, the plugin is not signed, so dependency verification has to use checksums.
See:
Note: if you release with GitHub Actions workflow, then you can generate PGP key and keep it in GitHub secrets.
See: https://github.com/vlsi/provision-release-pgp-key
The idea is that you add a workflow to trigger key provisioning like in https://github.com/pgjdbc/pgjdbc/blob/ee09a2f3bf2cb9031e2e325503281f2c1b2d4761/.github/workflows/pgp-key-maintenance.yaml
Then you manually trigger it and it generates and stores the key to GitHub variables. The same workflow can extends the key lifetime.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the GitHub Actions release process and the Gradle dependency verification documentation linked in the issue. Review the example .github/workflows/pgp-key-maintenance.yaml and the provision-release-pgp-key project to understand key provisioning and lifetime extension. Done means plugin releases are PGP-signed and the signing key is managed through GitHub secrets or variables.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, groovy
- Domain
- cryptography, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100