LUCENE-9488 Assemble source tar, with checksum and signing

[janhoy]

https://issues.apache.org/jira/browse/LUCENE-9488

Creates the source tar, with checksum and gpg signing. Usage:

./gradlew -Dversion.release=9.0.0 assembleSourceDist
ls -l lucene/packaging/build/distributions 
./gradlew -Psigning.gnupg.keyName=0D8D0B93 -Dversion.release=9.0.0 signSourceDistTar
ls -l lucene/packaging/build/distributions 

[janhoy]

First attempt on a solution, and it works. But I'm pretty sure there is a more optimal organization of the code, i.e. the task definition could perhaps live somewhere else.

Also, the sha512 hash generation is a raw copy/paste of some lines from elsewhere, probably some smart way to factor that out and make it DRY. Happy for suggestions.

[dweiss]

It's quite terrible gradle code, but it works! :) I will get back to clean this up some day, promise. I just don't have any ready to use solutions to copy from - the projects I have worked on just signed/ distributed maven artifacts, that's it.

I filed LUCENE-10152 to look into this one day. For the moment being, just feel free to move ahead.

[dweiss]

This would be typically an internal task attached to convention-style assemble:

assemble.dependsOn assembleSourceDist

Since we're using an external tool (git) and the whole process may be costly, I wouldn't worry about this.

[dweiss]

An input to this task could be the head commit's sha... this way it wouldn't re-run archiving of the same commit. Again - not important for now.

[dweiss]

What's 'assembleDist'? Where is it defined? findByName is not needed - if it's a known task, you can just say

assembleDist.dependsOn(assembleSourceDist)

but I can't find this task anywhere.

[janhoy]

I think it is defined by the distribution plugin. It will by default do distTar and distZip. I'll simplify the line..

[dweiss]

Ah... right - can be. I never used this plugin, so I'm not familiar with it.

[dweiss]

Thanks @janhoy !

[dsmiley]

I'm looking at this and seeing gradle/maven/publications-maven.gradle at the bottom has:

  tasks.withType(GenerateModuleMetadata) {
    enabled = false
  }

Added in this PR by @dweiss shown by git blame.
Why? This means if we use more sophisticated metadata like feature-variants (which I'm working on now for spatial-extras), it will not be published, which is a shame.

[dweiss]

Because back in the day it didn't work for me and broke downstream maven builds. If you'd like to check whether things work without it, please remove it and file a pr. I don't care.