Fork me on GitHub

pgpverify:go-offline

Full name:

org.simplify4u.plugins:pgpverify-maven-plugin:1.19.1:go-offline

Description:

Resolve OpenPGP signature and keys of all project and plugins dependencies.

Verification of signature in this goal will not occurs. In case of any problem only warn will be reported.

Attributes:

  • Requires a Maven project to be executed.
  • Requires dependency resolution of artifacts in scope: test.
  • The goal is thread-safe and supports parallel builds.
  • Since version: 1.13.0.

Required Parameters

Name Type Since Description
<pgpKeyServer> String 1.0.0 PGP public key servers address.

From version 1.7.0 you can provide many key servers separated by comma, semicolon or whitespace.

From version 1.15.0 hkp/http protocols are deprecated - please use hkps/https for key servers.


Default: hkps://keyserver.ubuntu.com, hkps://keys.openpgp.org, hkps://pgp.mit.edu
User Property: pgpverify.keyserver
<pgpKeysCachePath> File 1.0.0 The directory for storing cached PGP public keys.
Default: ${settings.localRepository}/pgpkeys-cache
User Property: pgpverify.keycache

Optional Parameters

Name Type Since Description
<keyNotFoundRefreshHour> int 1.15.0 When key does not exist on key servers such information will be stored in cache.

Next checking for key existence will be done after specific hours remain.


Default: 24
<pgpKeyServerLoadBalance> boolean 1.7.0 If many key servers are provided, use all of them.

If set to false only first key server will be used, another as fallback.


Default: false
User Property: pgpverify.keyserversLoadBalance
<proxyName> String 1.8.0 Choose which proxy to use (id from settings.xml in maven config). Uses no proxy if the proxy was not found. If it is not set, it will take the first active proxy if any or no proxy, if no active proxy was found.
User Property: pgpverify.proxyName
<quiet> boolean 1.4.0 Only log errors.
Default: false
User Property: pgpverify.quiet
<scope> String 1.0.0 Scope used to build dependency list.

This scope indicates up to which scope artifacts will be included. For example, the 'test' scope will include provided, compile, runtime, and system scoped dependencies.


Default: test
User Property: pgpverify.scope
<skip> boolean 1.3.0 Skip verification altogether.
Default: false
User Property: pgpverify.skip
<verifyAtypical> boolean 1.6.0 Verify dependency artifact in atypical locations:
  • annotation processors in org.apache.maven.plugins:maven-compiler-plugin configuration.

In addition, it will detect when maven-surefire-plugin version 3 is used, as this will dynamically resolve and load additional artifacts. However, these artifacts are not validated.


Default: false
User Property: pgpverify.verifyAtypical
<verifyPluginDependencies> boolean 1.8.0 Verify transitive dependencies of build plug-ins.

When enabled, configuration parameter verifyPlugins is enabled implicitly.


Default: false
User Property: pgpverify.verifyPluginDependencies
<verifyPlugins> boolean 1.5.0 Verify Maven build plug-ins.
Default: false
User Property: pgpverify.verifyPlugins
<verifyPomFiles> boolean 1.1.0 Verify pom files also.
Default: true
User Property: pgpverify.verifyPomFiles
<verifyProvidedDependencies> boolean 1.2.0 Verify "provided" dependencies, which the JDK or a container provide at runtime.
Default: false
User Property: pgpverify.verifyProvidedDependencies
<verifyReactorDependencies> boolean 1.3.0 Verify dependencies that are part of the current build (what Maven calls the "reactor").

This setting only affects multi-module builds that have inter-dependencies between modules. It has no effect on single-module projects nor on multi-module projects that do not have dependencies among the modules.

In affected builds, if this setting is true, and the current build is not applying GPG signatures, then the output artifacts of some of the modules in the build will not be signed. Consequently, other modules within the build that depend on those output artifacts will not pass the GPG signature check because they are unsigned. When this setting is false, GPG signatures are not checked on output artifacts of modules in the current build, to avoid this issue.


Default: false
User Property: pgpverify.verifyReactorDependencies
<verifySnapshots> boolean 1.2.0 Verify dependencies at a SNAPSHOT version, instead of only verifying full release version dependencies.
Default: false
User Property: pgpverify.verifySnapshots
<verifySystemDependencies> boolean 1.2.0 Verify "system" dependencies, which are artifacts that have an explicit path specified in the POM, are always available, and are not looked up in a repository.
Default: false
User Property: pgpverify.verifySystemDependencies

Parameter Details

<keyNotFoundRefreshHour>

When key does not exist on key servers such information will be stored in cache.

Next checking for key existence will be done after specific hours remain.

  • Type: int
  • Since: 1.15.0
  • Required: No
  • Default: 24

<pgpKeyServer>

PGP public key servers address.

From version 1.7.0 you can provide many key servers separated by comma, semicolon or whitespace.

From version 1.15.0 hkp/http protocols are deprecated - please use hkps/https for key servers.

  • Type: java.lang.String
  • Since: 1.0.0
  • Required: Yes
  • User Property: pgpverify.keyserver
  • Default: hkps://keyserver.ubuntu.com, hkps://keys.openpgp.org, hkps://pgp.mit.edu

<pgpKeyServerLoadBalance>

If many key servers are provided, use all of them.

If set to false only first key server will be used, another as fallback.

  • Type: boolean
  • Since: 1.7.0
  • Required: No
  • User Property: pgpverify.keyserversLoadBalance
  • Default: false

<pgpKeysCachePath>

The directory for storing cached PGP public keys.
  • Type: java.io.File
  • Since: 1.0.0
  • Required: Yes
  • User Property: pgpverify.keycache
  • Default: ${settings.localRepository}/pgpkeys-cache

<proxyName>

Choose which proxy to use (id from settings.xml in maven config). Uses no proxy if the proxy was not found. If it is not set, it will take the first active proxy if any or no proxy, if no active proxy was found.
  • Type: java.lang.String
  • Since: 1.8.0
  • Required: No
  • User Property: pgpverify.proxyName

<quiet>

Only log errors.
  • Type: boolean
  • Since: 1.4.0
  • Required: No
  • User Property: pgpverify.quiet
  • Default: false

<scope>

Scope used to build dependency list.

This scope indicates up to which scope artifacts will be included. For example, the 'test' scope will include provided, compile, runtime, and system scoped dependencies.

  • Type: java.lang.String
  • Since: 1.0.0
  • Required: No
  • User Property: pgpverify.scope
  • Default: test

<skip>

Skip verification altogether.
  • Type: boolean
  • Since: 1.3.0
  • Required: No
  • User Property: pgpverify.skip
  • Default: false

<verifyAtypical>

Verify dependency artifact in atypical locations:
  • annotation processors in org.apache.maven.plugins:maven-compiler-plugin configuration.

In addition, it will detect when maven-surefire-plugin version 3 is used, as this will dynamically resolve and load additional artifacts. However, these artifacts are not validated.

  • Type: boolean
  • Since: 1.6.0
  • Required: No
  • User Property: pgpverify.verifyAtypical
  • Default: false

<verifyPluginDependencies>

Verify transitive dependencies of build plug-ins.

When enabled, configuration parameter verifyPlugins is enabled implicitly.

  • Type: boolean
  • Since: 1.8.0
  • Required: No
  • User Property: pgpverify.verifyPluginDependencies
  • Default: false

<verifyPlugins>

Verify Maven build plug-ins.
  • Type: boolean
  • Since: 1.5.0
  • Required: No
  • User Property: pgpverify.verifyPlugins
  • Default: false

<verifyPomFiles>

Verify pom files also.
  • Type: boolean
  • Since: 1.1.0
  • Required: No
  • User Property: pgpverify.verifyPomFiles
  • Default: true

<verifyProvidedDependencies>

Verify "provided" dependencies, which the JDK or a container provide at runtime.
  • Type: boolean
  • Since: 1.2.0
  • Required: No
  • User Property: pgpverify.verifyProvidedDependencies
  • Default: false

<verifyReactorDependencies>

Verify dependencies that are part of the current build (what Maven calls the "reactor").

This setting only affects multi-module builds that have inter-dependencies between modules. It has no effect on single-module projects nor on multi-module projects that do not have dependencies among the modules.

In affected builds, if this setting is true, and the current build is not applying GPG signatures, then the output artifacts of some of the modules in the build will not be signed. Consequently, other modules within the build that depend on those output artifacts will not pass the GPG signature check because they are unsigned. When this setting is false, GPG signatures are not checked on output artifacts of modules in the current build, to avoid this issue.

  • Type: boolean
  • Since: 1.3.0
  • Required: No
  • User Property: pgpverify.verifyReactorDependencies
  • Default: false

<verifySnapshots>

Verify dependencies at a SNAPSHOT version, instead of only verifying full release version dependencies.
  • Type: boolean
  • Since: 1.2.0
  • Required: No
  • User Property: pgpverify.verifySnapshots
  • Default: false

<verifySystemDependencies>

Verify "system" dependencies, which are artifacts that have an explicit path specified in the POM, are always available, and are not looked up in a repository.
  • Type: boolean
  • Since: 1.2.0
  • Required: No
  • User Property: pgpverify.verifySystemDependencies
  • Default: false