Merge pull request #10 from Syquel/bugfix/MGPG-66

[MGPG-66] fix handling of excluded files
apache · Mar 16, 2021 · 12fbd63 · 12fbd63
2 parents 4016721 + 4da6921
commit 12fbd63
Show file tree

Hide file tree

Showing 3 changed files with 180 additions and 3 deletions.
diff --git a/src/it/sign-release-with-excludes/pom.xml b/src/it/sign-release-with-excludes/pom.xml
@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>org.apache.maven.its.gpg.srwe</groupId>
+  <artifactId>test</artifactId>
+  <version>1.0</version>
+  <packaging>jar</packaging>
+
+  <description>
+    Tests the exclusion of signature files while signing.
+  </description>
+
+  <properties>
+    <maven.test.skip>true</maven.test.skip>
+  </properties>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>2.0.2</version>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-gpg-plugin</artifactId>
+        <version>@project.version@</version>
+        <configuration>
+          <passphrase>TEST</passphrase>
+        </configuration>
+        <executions>
+          <execution>
+            <id>sign-artifacts</id>
+            <goals>
+              <goal>sign</goal>
+            </goals>
+          </execution>
+          <execution>
+            <!-- second signing run to test default exclusion of *.asc files -->
+            <id>resign-artifacts</id>
+            <goals>
+              <goal>sign</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-install-plugin</artifactId>
+        <version>2.2</version>
+        <configuration>
+          <updateReleaseInfo>true</updateReleaseInfo>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <version>2.1</version>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-resources-plugin</artifactId>
+        <version>2.2</version>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-source-plugin</artifactId>
+        <version>2.0.4</version>
+        <executions>
+          <execution>
+            <id>attach-sources</id>
+            <goals>
+              <goal>jar</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>2.3.1</version>
+      </plugin>
+    </plugins>
+  </build>
+
+</project>
diff --git a/src/it/sign-release-with-excludes/verify.bsh b/src/it/sign-release-with-excludes/verify.bsh
@@ -0,0 +1,58 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.List;
+import org.codehaus.plexus.util.FileUtils;
+
+File artifactDir = new File( localRepositoryPath, "org/apache/maven/its/gpg/srwe/test/1.0" );
+
+String[] expectedFiles = {
+    "_remote.repositories",
+    "test-1.0.pom",
+    "test-1.0.pom.asc",
+    "test-1.0.jar",
+    "test-1.0.jar.asc",
+    "test-1.0-sources.jar",
+    "test-1.0-sources.jar.asc",
+};
+
+for ( File file : artifactDir.listFiles() )
+{
+    String fileName = file.getName();
+    System.out.println( "Checking if file is expected: " + fileName );
+
+    boolean expected = false;
+    for ( String expectedFile : expectedFiles )
+    {
+        if ( expectedFile.equals( fileName ) )
+        {
+            expected = true;
+            break;
+        }
+    }
+
+    if ( !expected )
+    {
+        throw new Exception( "Unexpected file " + file );
+    }
+}
diff --git a/src/main/java/org/apache/maven/plugins/gpg/GpgSignAttachedMojo.java b/src/main/java/org/apache/maven/plugins/gpg/GpgSignAttachedMojo.java
@@ -21,6 +21,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -192,6 +193,12 @@ else if ( project.getAttachedArtifacts().isEmpty() )
 
             File file = artifact.getFile();
 
+            if ( isExcluded( artifact ) )
+            {
+                getLog().debug( "Skipping generation of signature for excluded " + file );
+                continue;
+            }
+
             getLog().debug( "Generating signature for " + file );
 
             File signature = signer.generateSignatureForArtifact( file );
@@ -217,19 +224,24 @@ else if ( project.getAttachedArtifacts().isEmpty() )
     /**
      * Tests whether or not a name matches against at least one exclude pattern.
      *
-     * @param name The name to match. Must not be <code>null</code>.
+     * @param artifact The artifact to match. Must not be <code>null</code>.
      * @return <code>true</code> when the name matches against at least one exclude pattern, or <code>false</code>
      *         otherwise.
      */
-    protected boolean isExcluded( String name )
+    protected boolean isExcluded( Artifact artifact )
     {
+        final Path projectBasePath = project.getBasedir().toPath();
+        final Path artifactPath = artifact.getFile().toPath();
+        final String relativeArtifactPath = projectBasePath.relativize( artifactPath ).toString();
+
         for ( String exclude : excludes )
         {
-            if ( SelectorUtils.matchPath( exclude, name ) )
+            if ( SelectorUtils.matchPath( exclude, relativeArtifactPath ) )
             {
                 return true;
             }
         }
+
         return false;
     }