Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-18 Thread Emmanuel Venisse
Brett Porter a écrit : Ah, I see... sorry I misunderstood. So - it works correctly right now? In a single pom, it signs it normally and skips the additional signing of the non-existent attached artifact? Yes. If so, sorry for the noise. np. Emmanuel - Brett On 18/12/2006, at 7:29

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-18 Thread Brett Porter
Ah, I see... sorry I misunderstood. So - it works correctly right now? In a single pom, it signs it normally and skips the additional signing of the non-existent attached artifact? If so, sorry for the noise. - Brett On 18/12/2006, at 7:29 PM, Emmanuel Venisse wrote: My fix remove only a

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-18 Thread Emmanuel Venisse
My fix remove only a NPE when packaging is pom. Without that, the plugin tried to sync artifact, but it doesn't exist when packaging is pom. Emmanuel Brett Porter a écrit : I heard the same objection from Wendy. Can we roll this change back? /me needs to track his objections more carefully, n

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-17 Thread Brett Porter
I heard the same objection from Wendy. Can we roll this change back? /me needs to track his objections more carefully, noting this has been released since. - Brett On 09/12/2006, at 11:25 AM, Brett Porter wrote: Why not? I think signing the metadata is just as important. - Brett On 09/12

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-08 Thread Brett Porter
Sorry, responded having read the commits list, not the dev list :) I agreed with your mail - when I said metadata I meant POMs. Definitely don't need to sign maven-metadata.xml. - Brett On 09/12/2006, at 12:19 PM, Wendy Smoak wrote: On 12/8/06, Brett Porter <[EMAIL PROTECTED]> wrote: Why

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-08 Thread Wendy Smoak
On 12/8/06, Brett Porter <[EMAIL PROTECTED]> wrote: Why not? I think signing the metadata is just as important. The maven-metadata.xml files? 1. It's not required by the readme file and 2. They change on every deployment, so you'd be overwriting the signature, which could well belong to someo

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-08 Thread Brett Porter
Why not? I think signing the metadata is just as important. - Brett On 09/12/2006, at 2:53 AM, [EMAIL PROTECTED] wrote: Author: evenisse Date: Fri Dec 8 07:53:20 2006 New Revision: 484646 URL: http://svn.apache.org/viewvc?view=rev&rev=484646 Log: Don't generate signature on artifact when the

Re: svn commit: r484646 - in /maven/plugins/trunk/maven-gpg-plugin: ./ src/main/java/org/apache/maven/plugin/gpg/GpgSignAttachedMojo.java

2006-12-08 Thread Wendy Smoak
On 12/8/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: Author: evenisse Date: Fri Dec 8 07:53:20 2006 New Revision: 484646 URL: http://svn.apache.org/viewvc?view=rev&rev=484646 Log: Don't generate signature on artifact when the project is a pom I think poms also need to be signed, see: http