Update signing config, fix configuration-cache compatibility #3058

mateuszkwiecinski · 2025-07-14T22:01:38Z

Description

This PR introduces the following set of behavior changes:

signing config has been extracted from shadowJarExecutable task into signShadowJarExecutable to make it compatible with configuration cache
- running shadowJarExecutable automatically runs shadowJarExecutableChecksum so the user-facing behavior is the same.

Before	After

Running shadowJarExecutable will also generate md5 checksums (disabled by https://github.com/pinterest/ktlint/pull/1952/files#diff-10bb684577395d2b98c65f30064e347f353307c7c4956b0a147b26e3085f3bbfL88. 0.48.2 had checksums attached, 0.49.0 did not). Changes from this PR should make them appear again on the artifacts list
- I couldn't find any usages of shadowJarExecutableChecksum task, which directly addressed: Provide checksum file along with release #695 . Please let me know if checksums aren't meant to be published I'll then propose to remove all the checksum related code.

Before	After

Tasks expose very explicit inputs&outputs rather than passing parent directory reference around. That way running task multuple times (with --rerun flag results in a deterministic behavior)

Checklist

Before submitting the PR, please check following (checks which are not relevant may be ignored):

Commit message are well written. In addition to a short title, the commit message also explain why a change is made.
At least one commit message contains a reference Closes #<xxx> or Fixes #<xxx> (replace<xxx> with issue number)
Tests are added
KtLint format has been applied on source code itself and violations are fixed
PR title is short and clear (it is used as description in the release changelog)
PR description added (background information)

Documentation is updated. See difference between snapshot and release documentation

Snapshot documentation in case documentation is to be released together with a code change
Release documentation in case documentation is related to a released version of ktlint and has to be published as soon as the change is merged to master

build-logic/src/main/kotlin/ShadowJarExecutableTask.kt

ktlint-cli/build.gradle.kts

mateuszkwiecinski · 2025-07-15T06:25:04Z

ktlint-cli/build.gradle.kts

+    windowsBatchScriptSource.set(layout.projectDirectory.file("src/main/scripts/ktlint.bat"))
+    outputDirectory.set(ktlintOutputRoot)
+
+    finalizedBy("signShadowJarExecutable", "shadowJarExecutableChecksum")


This is the configuration-cache compatibility fix. Previously the build tried to sign ktlint executable file as a part of shadowJarExecutable invocation, now it'll run after shadowJarExecutable completes, after the executable file has actually been created

ktlint-cli/build.gradle.kts

mateuszkwiecinski · 2025-07-15T06:34:36Z

ktlint-cli/build.gradle.kts

-    val outputDirectoryPath =
-        layout.buildDirectory
-            .dir("run")
+            .archiveFile


shadowJar exposes a named output, so I updated the code so it's used here as well rather than iterating over outputs manually

mateuszkwiecinski

My understanding is the build failed because it tries to sign the artifacts (since the project version set to stable one), but it doesn't have access to singing keys given the PR is opened from a fork.

paul-dingemans · 2025-07-15T18:04:30Z

Please let me know if checksums aren't meant to be published I'll then propose to remove all the checksum related code.

Looking at the commits in the PR #1952 it is clear that the change was initiated by @Goooler. At April 20, 2023 @shashachu reverted the signing, followed by the release of version 0.49.0 on April 21, 2023. So it looks like that during release of 0.49.0 a blocking problem occurred, which was resolved by partially reverting the signing. To me this sounds that the signing was accidentally removed to unblock the release.

Having said that, we can argue about the value of having the md5 files being published. No one has complained about a regression since the md5 files are missing.

Does any of you have an argument in favor, or against re-adding the md5 functionality?

mateuszkwiecinski · 2025-07-15T18:26:36Z

Artifacts available on Maven central have their own authenticity certification: signature, hash, so from my perspective those hashes are useful only for people downloading artifacts directly from github release page (does that include homebrew? I have close to zero knowledge how homebrew works 😬 )

At the same time nothing prevents an attacker to swap both executable and hash file (releases can be edited, new artifact files can be uploaded), so I don't know if the checksum comes with any safety guarantee 😅

tl;dr I don't think these extra checksums bring any value, especialy they are gone for >2 years 😅

paul-dingemans · 2025-07-15T19:11:33Z

so from my perspective those hashes are useful only for people downloading artifacts directly from github release page (does that include homebrew? I have close to zero knowledge how homebrew works 😬 )

Github release pahe publishes the SHA256 for this:

Also in ktlint documentation it is explained how to verify the downloaded file.

tl;dr I don't think these extra checksums bring any value, especialy they are gone for >2 years 😅

Agree. @Goooler, @shashachu, what do you think?

mateuszkwiecinski · 2025-07-15T19:19:34Z

Github release pahe publishes the SHA256 for this:

:TIL:, looks like relatively new feature? None of the previous releases had such metadata attached 👀

by introducing separate signing task

Do not generate checksum for signature file

mateuszkwiecinski · 2025-07-16T10:06:14Z

build-logic/src/main/kotlin/PublicationPlugin.kt

+                    // Avoid setting empty strings as signing keys. This avoids breaking the build when PR is opened from a fork.
+                    // Also, due to https://github.com/gradle/gradle/issues/18477 signing tasks try to prematurely access the signatory.
+                    // This also improves error messages if something's misconfigured
+                    useInMemoryPgpKeys(signingKeyId, signingKey, signingPassword)


The new task I added (signShadowJarExecutable) gets created eagerly, tries to access the signatory and fails if the signing info contains empty string (not nulls)

As a workaround I'm proposing to configure the signing conditionally. This solves the misbehavior of the Sign task, but also should not fail PRs from froks created during release (the isRequired property is not the only input that determines if the signing tasks should run - link)

mateuszkwiecinski · 2025-07-16T10:08:04Z

The checksum calculating code has been removed in 9ec1ec6 ✅

Goooler · 2025-07-16T10:36:11Z

I don't like this idea, I don't like #3047 too.

mateuszkwiecinski · 2025-07-16T13:30:32Z

I don't like this idea, I don't like #3047 too.

@Goooler You have to be more specific 😄 I fail to find how such feedback would be actionable 😅

paul-dingemans

My understanding of this part of the build is increased a lot. I have a lot of naming things that might improve the code even more. Please have a look at the suggestions.

build-logic/src/main/kotlin/PublicationPlugin.kt

build-logic/src/main/kotlin/ShadowJarExecutableTask.kt

ktlint-cli/build.gradle.kts

build-logic/src/main/kotlin/ShadowJarExecutableTask.kt

mateuszkwiecinski · 2025-07-20T15:01:20Z

Thanks for clearing that up in #3078 🙏

mateuszkwiecinski force-pushed the fix_configuration_cache_compatibility branch 2 times, most recently from 2f43d90 to b5fb3af Compare July 14, 2025 23:10

mateuszkwiecinski commented Jul 15, 2025

View reviewed changes

mateuszkwiecinski force-pushed the fix_configuration_cache_compatibility branch from b5fb3af to af74d3a Compare July 16, 2025 08:15

mateuszkwiecinski changed the title ~~Update signing config, restore MD5 checksums, fix configuration-cache compatibility~~ Update signing config, fix configuration-cache compatibility Jul 16, 2025

mateuszkwiecinski added 3 commits July 16, 2025 10:48

Fix configuration cache compatibility

285d94f

by introducing separate signing task

Always generate signature & checksum files

dc8ff66

Do not generate checksum for signature file

Remove checksum generating code

9ec1ec6

mateuszkwiecinski force-pushed the fix_configuration_cache_compatibility branch from af74d3a to 9ec1ec6 Compare July 16, 2025 08:48

Do not configure signatory with empty key info

de74284

mateuszkwiecinski commented Jul 16, 2025

View reviewed changes

mateuszkwiecinski mentioned this pull request Jul 16, 2025

Switch publication config to vanniktech's maven-publish plugin #3068

Open

8 tasks

mateuszkwiecinski marked this pull request as ready for review July 16, 2025 10:07

paul-dingemans reviewed Jul 16, 2025

View reviewed changes

paul-dingemans merged commit 2d7a94a into pinterest:master Jul 19, 2025
12 checks passed

Update signing config, fix configuration-cache compatibility #3058

Update signing config, fix configuration-cache compatibility #3058

Uh oh!

Conversation

mateuszkwiecinski commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mateuszkwiecinski Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mateuszkwiecinski Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

mateuszkwiecinski left a comment

Choose a reason for hiding this comment

Uh oh!

paul-dingemans commented Jul 15, 2025

Uh oh!

mateuszkwiecinski commented Jul 15, 2025

Uh oh!

paul-dingemans commented Jul 15, 2025

Uh oh!

mateuszkwiecinski commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mateuszkwiecinski Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateuszkwiecinski commented Jul 16, 2025

Uh oh!

Goooler commented Jul 16, 2025

Uh oh!

mateuszkwiecinski commented Jul 16, 2025

Uh oh!

paul-dingemans left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mateuszkwiecinski commented Jul 20, 2025

Uh oh!

Uh oh!

mateuszkwiecinski commented Jul 14, 2025 •

edited

Loading

mateuszkwiecinski commented Jul 15, 2025 •

edited

Loading

mateuszkwiecinski Jul 16, 2025 •

edited

Loading