Pin the Maven gpg plugin to 3.1.0

When running `mvn gpg:sign-and-deploy-file ...` Maven uses the latest available version which is 3.2.0 (https://github.com/apache/maven-gpg-plugin/releases/tag/maven-gpg-plugin-3.2.0). Using 3.2.0 makes our tests fail, so we tentatively pin to 3.1.0 until we do further investigations. PiperOrigin-RevId: 614822141 Change-Id: I4c68d1c564f1692063300c4292243b65c14bfcaa
tink-crypto · Mar 11, 2024 · c0e344c · c0e344c
1 parent 52b4c5e
commit c0e344c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/maven/maven_deploy_library.sh b/maven/maven_deploy_library.sh
@@ -110,8 +110,9 @@ parse_args() {
       if [[ -z "${GIT_URL}" ]]; then
         usage
       fi
+      # TODO(b/329143784): Move to 3.2.0 when possible.
       MAVEN_ARGS+=(
-        "gpg:sign-and-deploy-file"
+        "org.apache.maven.plugins:maven-gpg-plugin:3.1.0:sign-and-deploy-file"
         "-DrepositoryId=ossrh"
         "-Durl=https://oss.sonatype.org/service/local/staging/deploy/maven2/"
         "-Dgpg.keyname=tink-dev@google.com"

diff --git a/maven/maven_deploy_library_test.sh b/maven/maven_deploy_library_test.sh
@@ -156,7 +156,8 @@ test_MavenDeployLibraryTest_ReleaseSucceeds() {
 
   cat << EOF > expected_commands.txt
 bazel build tink.jar tink-src.jar tink-javadoc.jar
-mvn gpg:sign-and-deploy-file -DrepositoryId=ossrh \
+mvn org.apache.maven.plugins:maven-gpg-plugin:3.1.0:sign-and-deploy-file \
+-DrepositoryId=ossrh \
 -Durl=https://oss.sonatype.org/service/local/staging/deploy/maven2/ \
 -Dgpg.keyname=tink-dev@google.com \
 --settings=${TEST_CASE_TMPDIR}/${RELATIVE_MVN_DIR_PATH}/settings.xml \