Repository navigation
[BUG] Start signing com.google.prefab:cli:2.0.0 artifacts #157
Description
Activity
Sounds like https://docs.gradle.org/current/userguide/signing_plugin.html is the way to do the actual signing, and https://cloud.google.com/build/docs/securing-builds/use-secrets seems to be the correct way to hide the secrets.
Any updates here?
It's not currently being worked on.
com.google.prefab:cli:2.0.0 artifacts in gmaven are currently not signed (missing .asc artifacts), which makes it not possible to verify if prefab was actually build by Google or not. A large number of libraries and build tools in maven already sign their artifacts, it would be great to see prefab do the same to allow signature validation when using it.