Gradle Signing plugin

This Gradle plugin simplifies signing your artifacts. It automatically applies the standard Signing Plugin and configures in-memory PGP keys from environment variables or Gradle properties.

Initialization

plugins {
    id("dev.g000sha256.signing") version "<latest>"
}

Configuration

Add keys

For CI/CD, the plugin reads the credentials from environment variables:

SIGNING_KEY=<your signing key>
SIGNING_PASSWORD=<your signing password>
# optional
SIGNING_KEY_ID=<your signing key id>

You can also store the credentials in your private Gradle properties file (~/.gradle/gradle.properties):

signing.key=<your signing key>
signing.password=<your signing password>
# optional
signing.keyId=<your signing key id>

Note

The plugin reads each value in the following order: environment variable, then Gradle property. If a key or password cannot be resolved, the plugin skips configuring in-memory keys - the standard Signing plugin's file-based credentials (signing.keyId, signing.password, signing.secretKeyRingFile) still work.

Sign

A specific publication:

signing {
    val publication = publishing.publications["<your publication name>"]
    sign(publication)
}

or all publications:

signing {
    sign(publishing.publications)
}

See signing publications in the Gradle docs for more options.

Override

Your own signing block runs after this plugin, so you can replace the configured keys:

signing {
    useInMemoryPgpKeys("<your signing key>", "<your signing password>")
}