Best way(s) to manage credentials and gpg sign on a automate build process (jenkins or travis)

[Milamber]

Hello,

I send this message on users@infra.a.o to ask some advice for JMeter 
release process. If it's not the right list, please indicate me the good 
list.

On JMeter project, we have a release process with a lot of manual steps, 
generally because the steps include operations with authentication or 
password like the GPG signing archives, the upload on dist.a.o or the 
release package under Nexus.

https://wiki.apache.org/jmeter/ReleaseCreation

We want try to automate at the maximum the release process to allow to 
release more often using a build tool like Jenkins or travis (or 
another). So with the least human actions.

Do you have suggestions / examples?


Particularly for these actions:

[...]
ant sign_dist -Dgpg.keyname=0612B399 
-Dgpg.secretKeyring=~/.gnupg/secring.gpg


[...]
ant maven_upload -Djmeter.version=3.2 -DrepoType=releases

    Go to Apache Repository (https://repository.apache.org/)
        Section Staging Repositories
            Check the RC box, add click on Close button (see Closing a 
staging repository)

[...]

ant RC_upload -DRC=RCn -DrepoType=live [-Dasf.ldap.password=secret 
[-Dasf.ldap.username=user] ]

Thanks.

Milamber