maven 2 - How to ensure signing of test-jars in package phase? -
i have multi-module project parent pom specifies (in profile) configuration , use of maven-jarsigner-plugin sign jars project produces.
<profile> <id>sign</id> <build> <plugins> <plugin> <groupid>org.apache.maven.plugins</groupid> <artifactid>maven-jarsigner-plugin</artifactid> <version>1.2</version> <executions> <execution> <id>sign-jars</id> <goals> <goal>sign</goal> </goals> </execution> </executions> <configuration> <keystore>/tmp/certificates.ks</keystore> <alias>jarsign</alias> <storepass>password</storepass> <keypass>password</keypass> </configuration> </plugin> </plugins> </build> </profile>
some of sub-modules in project additionally use maven-jar-plugin produce test jar:
<plugin> <groupid>org.apache.maven.plugins</groupid> <artifactid>maven-jar-plugin</artifactid> <executions> <execution> <id>test-jar</id> <phase>package</phase> <configuration> </configuration> <goals> <goal>test-jar</goal> </goals> </execution> </executions> </plugin>
i'm observing when signing profile enabled (e.g., mvn -psign install
) maven executes goals in following order:
- jar:jar
- jarsigner:sign
- jar:test-jar
- install:install
this results in unsigned test-jar (both in target/
, in local repository) causes java security problems when subsequent project attempts use test-jar.
is there way ensure jar:jar , jar:test-jar execute prior jarsigner:sign?
move test-jar
execution prepare-package
phase, there time jarsigner gets go.
alternatively, specify signing profile in same pom test-jar.
i have similar situation assembly plugin, if assembly , jarsigner in same pom, order fine, if jarsigner in parent pom, order bad (maven 2.2.1).
Comments
Post a Comment