Add password to gpg signing setup.

apache · May 23, 2024 · 2feca79 · 2feca79
1 parent 0143dff
commit 2feca79
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/.ci/jenkins/Jenkinsfile.deploy b/.ci/jenkins/Jenkinsfile.deploy
@@ -154,11 +154,14 @@ pipeline {
                         }
                         if (isRelease()) {
                             withCredentials([file(credentialsId: 'asf-release-gpg-signing-key', variable: 'SIGNING_KEY')]) {
-                                // copy the key to singkey.gpg file in *plain text* so we can import it
-                                sh ('cat $SIGNING_KEY > $WORKSPACE/signkey.gpg')
-                                // import the key into the gpg keyring
-                                sh ('gpg --allow-secret-key-import --import signkey.gpg')
-                                sh ('rm $WORKSPACE/signkey.gpg')
+                                withCredentials([file(credentialsId: 'asf-release-gpg-signing-key-password', variable: 'SIGNING_KEY_PASSWORD')]) {
+                                    // copy the key to singkey.gpg file in *plain text* so we can import it
+                                    sh ('cat $SIGNING_KEY > $WORKSPACE/signkey.gpg')
+                                    // Please do not remove list keys command. When gpg is run for the first time, it may initialize some internals.
+                                    sh ('gpg --list-keys')
+                                    sh ("gpg --batch --pinentry-mode=loopback --passphrase \"${SIGNING_KEY_PASSWORD}\" --import signkey.gpg")
+                                    sh ('rm $WORKSPACE/signkey.gpg')
+                                }
                             }
                             mvnCmd.withProfiles(['apache-release'])
                         }