Search code examples
sbttravis-cignupgpgpsonatype

sbt publishSigned on Sonatype Nexus via Travis CI with using pgpPassphrase

I've build an OSS project https://github.com/datlinq/scalafiniti The Travis-ci pipeline works perfectly, but for 1 final step.

I followed these guides:

Locally I got all steps working fine and actually published to the Nexus.

In the .travis.yml I import the key before install (Encrypted in travis.ci env)

before_install:
 - echo "$PGP_SECRET" | base64 --decode | gpg --import
 - echo "$PGP_TRUST" | base64 --decode | gpg --import-ownertrust

The $PGP_PASS is also encrypted in Travis env and available for the build.sbt

I checked it actually gets the key in this command

pgpPassphrase := sys.env.get("PGP_PASS").map(_.toArray)

Now if Travis runs the command

sbt publishSigned

It still prompts for a passphrase for my key

You need a passphrase to unlock the secret key for user: "com.datlinq.datalabs (Key for Datalabs OSS) " 2048-bit RSA key, ID 305DA15D, created 2017-09-01

Enter passphrase:

I don't know what I should do to make this work

This moment in time is captured:

code: https://github.com/datlinq/scalafiniti/tree/0d8a6a92bf111bae2a1081b17005a649f8fd00c9 build log: https://travis-ci.org/datlinq/scalafiniti/builds/271328874

Solution

  • So, the reason it prompted for a password and ignored all sbt based configurations was due to the fact the build script used the local gnupg installation instead of the one packaged with sbt-pgp (bouncy castle). The local gpg wants you to manually enter the password the first time. A bit hard using TravisCI

    So the solution was ignore the local gpg and use the bundled one, that uses the pgpPassphrase setting

    Looking back to the documentation:

    In one of the first lines it actual says:

    If you’re using the built-in Bouncy Castle PGP implementation, skip this step.

    The first step towards using the GPG command line tool is to make sbt-pgp gpg->aware.

    useGpg := true

    So the solution was to set useGpg := false

    For more details look at the current repo: https://github.com/datlinq/scalafiniti

    Or check this blog (which I found later) https://alexn.org/blog/2017/08/16/automatic-releases-sbt-travis.html