GPG signatures in non-Maven-P2 repositories

[reckart]

The tycho-p2-repository:assemble-maven-repository mojo has an option includePGPSignature which embeds the PGP signatures of the Maven artifacts in the P2 repository metadata.

Unfortunately, the tycho-p2-repository:assemble-repository mojo does not have this option.

Is includePGPSignature something that could be added to tycho-p2-repository:assemble-repository, or does it not make sense?

[laeubi]

Is includePGPSignature something that could be added to tycho-p2-repository:assemble-repository, or does it not make sense?

It is (not yet) supported see for example #661 but you can (re) (pgp) sign it with the https://www.eclipse.org/tycho/sitedocs/tycho-gpg-plugin/sign-p2-artifacts-mojo.html

[reckart]

Apparently the PGP signatures included in the p2 repositories are not supported yet by Eclipse.

There is an old thread from 2021 regarding adding support for PGP signatures when validating bundles during install, but I tried Eclipse 2022-03 and Eclipse 2022-06-R1 with the repos signed by the
tycho-gpg-plugin, but both do not recognizes the signatures.

[reckart]

@mickaelistria has there been any news on the PGP support in Eclipse since that thread you started in 2021?

[mickaelistria]

PGP signatures are supported. Please verify that the artifacts you're trying to install do actually have signature metadata, and that there isn't another repository providing an unsigned version of the artifacts during installation.

[reckart]

I've been able to get Eclipse to recognize the PGP signatures in a minimal example... now I need to figure out why it doesn't work in the actual build that I'm working on... 🤔

[laeubi]

@mickaelistria can you take a look into this issue?

• tycho-p2-repository:assemble-repository bundles **ALL** public keys from the local keyring if keyname not set #948