[JIRA] (JPAR-190) Investigate an enforcer to check all jars and poms ~/.m2/.... towards the end of a build

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on JPAR-190 ( https://shibboleth.atlassian.net/browse/JPAR-190?atlOrigin=eyJpIjoiZWU3NmM0ZGY2M2UxNGI1ZGE5MzU1OWRhZWFlM2U4ZmMiLCJwIjoiaiJ9 )

Re: Investigate an enforcer to check all jars and poms ~/.m2/.... towards the end of a build ( https://shibboleth.atlassian.net/browse/JPAR-190?atlOrigin=eyJpIjoiZWU3NmM0ZGY2M2UxNGI1ZGE5MzU1OWRhZWFlM2U4ZmMiLCJwIjoiaiJ9 )

We already handle unsigned artifacts. We sign them and store the signatures locally. Then the flow is exactly the same as for everything else bar where the sig comes from.

see this link ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=tree;f=idp-distribution/src/main/enforcer/localSignatures;h=777426db2054417fdf54f9168de4c3f4e6ef9122;hb=HEAD )

For things which are locally signed (like antlr)

* While our repo is on the chain it “just works”
* When we pull our maven repo (which ISTC will never happen) it suffices to copy the asc file into that location and commit it,

Moving forward there should be *no reason* to have to sign an artifact. I have signed the ones we currently use and the other have asc files in our maven repo

( https://shibboleth.atlassian.net/browse/JPAR-190#add-comment?atlOrigin=eyJpIjoiZWU3NmM0ZGY2M2UxNGI1ZGE5MzU1OWRhZWFlM2U4ZmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JPAR-190#add-comment?atlOrigin=eyJpIjoiZWU3NmM0ZGY2M2UxNGI1ZGE5MzU1OWRhZWFlM2U4ZmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:8e458bc )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/a70f3b96/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c29d688a-77ae-425c-832a-a8cba85f580d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/a70f3b96/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-53cbc51d-03f5-43d2-a1a1-29105e5444f7
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/a70f3b96/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-e5b7b38d-5d17-4131-a998-320f9604e586
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/a70f3b96/attachment-0005.png>