@bissim,

About your two questions:

1. How do I properly set artifact signing with Setup Java JDK action?

   The ‘settings-security.xml’ file contains the master password used to encrypt remote repository credentials. The default location of this file is ‘~<user_home>/.m2/settings-security.xml’.

   Normally, if this file does not exist, or if it does not contain valid content, the ‘mvn --encrypt-password’ command line will fail with the error like:

   [ERROR] java.io.FileNotFoundException: ~<user_home>/.m2/settings-security.xml (No such file or directory)
   

   In this situation, you may need to create this file by yourself, then copy and paste the encrypted master password (output of the command line ‘mvn --encrypt-master-password’) into the file.

   If you do not store the ‘settings-security.xml’ file in the directory ‘~<user_home>/.m2’, for example in your project repository directory, you can try to use the following command line to refer to this file:

   mvn -Dsettings.security=path/to/settings-security.xml
   

2. How do I avoid failing of two subsequent cleanup for the same kind actions?

   You can try to divide the current job to two jobs in your workflow. One is for “Publish GitHub Packages Apache Maven”, another is for “Publish to Apache Maven Central”.
   In this way, the Setup Java JDK action is running in different jobs on different runner machines, they will not have any effect or conflict on each other.

Hello @brightran,
Thank you for your answer.

About number 2, it makes sense: I was avoiding to use multiple jobs in order not to duplicate steps because of two different runners; I think there’s no other way to fix that problem.

About number 1, I wonder whether there’s a way to create a working settings-security.xml file remotely: I guess that prepending a step with mvn --encrypt-master-password command won’t solve the problem, also because it prompts for a password. This is really a problem: I cannot interact with runners, unless I make use of some really bash commands.

Edit: by the way, why isn’t this problem documented into ‘Publishing Java projects with Maven’ documentation?

Edit2: can’t I just disable password encryption mechanism? In the first place, I don’t need such a level of security, since I’m using a disposable runner and passwords aren’t even encrypted in generated settings.xml file.

Edit3: I managed to get rid of the error about settings-security.xml by passing server username and password and GPG key passphrase as environment variables rather than directly to Setup Java configuration, like shown in Setup Java README. The error I’m getting now is

gpg: signing failed: Inappropriate ioctl for device

that cannot be fixed by export GPG_TTY=$(tty).
So, does anyone know how to fix this issue?

@bissim,

In the docs “Publishing Java packages with Maven”, it seems only mentions using passwrod (personal access token) to authenticate, not mentions using GPG keys. And looks like, all the authentication information will be stored into the automatically generated settings.xml.
Not sure why the settings-security.xml will be involved.

I have created an issue ticket (actions/setup-java#91) to help you report the questions to the appropriate engineering team for further investigation and evaluation.
You can follow this issue ticket and add your comments on it.

You can also use another plugin Sign Maven Plugin – Introduction it doesn’t use gpp for signing.

sign-maven-plugin support all configuration item as environment variable, so configuration for CI system like GitHub Actions is more easier and simply work without difficult configuration.

It also is operating system independent because needn’t external software.