Build: Simplify signing + fix execution in polaris-distribution

build-logic/src/main/kotlin/publishing/PublishingHelperPlugin.kt

@@ -79,7 +79,6 @@ constructor(private val softwareComponentFactory: SoftwareComponentFactory) : Pl
       extensions.create("publishingHelper", PublishingHelperExtension::class.java)
 
       val isRelease = project.hasProperty("release")
-      val isSigning = isRelease || project.hasProperty("signArtifacts")
 
       // Adds Git/Build/System related information to the generated jars, if the `release` project
       // property is present. Do not add that information in development builds, so that the
@@ -102,7 +101,7 @@ constructor(private val softwareComponentFactory: SoftwareComponentFactory) : Pl
         configureOnRootProject(project)
       }
 
-      if (isSigning) {
+      if (isSigningEnabled()) {
         plugins.withType<SigningPlugin>().configureEach {
           configure<SigningExtension> {
             val signingKey: String? by project

build-logic/src/main/kotlin/publishing/rootProject.kt

@@ -28,7 +28,6 @@ import org.gradle.api.tasks.Exec
 import org.gradle.kotlin.dsl.apply
 import org.gradle.kotlin.dsl.named
 import org.gradle.kotlin.dsl.register
-import org.gradle.plugins.signing.Sign
 
 /**
  * Configures Apache project specific publishing tasks on the root project, for example the
@@ -39,7 +38,6 @@ internal fun configureOnRootProject(project: Project) =
     apply<NexusPublishPlugin>()
 
     val isRelease = project.hasProperty("release")
-    val isSigning = isRelease || project.hasProperty("signArtifacts")
 
     val sourceTarball = tasks.register<Exec>("sourceTarball")
     sourceTarball.configure {
@@ -61,6 +59,8 @@ internal fun configureOnRootProject(project: Project) =
         "HEAD",
       )
       workingDir(project.projectDir)
+
+      outputs.file(e.sourceTarball)
     }
 
     val digestSourceTarball =
@@ -75,18 +75,7 @@ internal fun configureOnRootProject(project: Project) =
 
     sourceTarball.configure { finalizedBy(digestSourceTarball) }
 
-    if (isSigning) {
-      val signSourceTarball =
-        tasks.register<Sign>("signSourceTarball") {
-          description = "Sign the source tarball"
-          mustRunAfter(sourceTarball)
-          doFirst {
-            val e = project.extensions.getByType(PublishingHelperExtension::class.java)
-            sign(e.sourceTarball.get().asFile)
-          }
-        }
-      sourceTarball.configure { finalizedBy(signSourceTarball) }
-    }
+    signTaskOutputs(sourceTarball)
 
     val releaseEmailTemplate = tasks.register("releaseEmailTemplate")
     releaseEmailTemplate.configure {

build-logic/src/main/kotlin/publishing/signing.kt

@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package publishing
+
+import org.gradle.api.Project
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.internal.extensions.stdlib.capitalized
+import org.gradle.plugins.signing.SigningExtension
+
+fun Project.isSigningEnabled(): Boolean = hasProperty("release") || hasProperty("signArtifacts")
+
+/**
+ * Convenience function to sign all output files of the given task.
+ *
+ * Only triggers signing, if the `release` or `signArtifacts` project property is set.
+ */
+fun Project.signTaskOutputs(task: TaskProvider<*>): Unit {
+  if (isSigningEnabled()) {
+    val signingTask = tasks.register("sign" + task.name.capitalized())
+    signingTask.configure {
+      dependsOn(task)
+      actions.addLast {
+        val files = task.get().outputs.files.files
+        files.forEach { file -> logger.info("Signing $file for '${task.get().path}'") }
+        val ext = project.extensions.getByType(SigningExtension::class.java)
+        ext.sign(*files.toTypedArray())
+      }
+    }
+    task.configure { finalizedBy(signingTask) }
+  }
+}

runtime/distribution/build.gradle.kts

@@ -19,6 +19,7 @@
 
 import publishing.GenerateDigest
 import publishing.PublishingHelperPlugin
+import publishing.signTaskOutputs
 
 plugins {
   id("distribution")
@@ -98,9 +99,6 @@ distTar.configure { finalizedBy(digestDistTar) }
 
 distZip.configure { finalizedBy(digestDistZip) }
 
-if (project.hasProperty("release") || project.hasProperty("signArtifacts")) {
-  signing {
-    sign(distTar.get())
-    sign(distZip.get())
-  }
-}
+signTaskOutputs(distTar)
+
+signTaskOutputs(distZip)