3.2.0

Release Notes - Maven GPG Plugin - Version 3.2.0

Bug

• [MGPG-85] - Regression in maven-metadata for SNAPSHOTs between 1.6 and 3.0.1
• [MGPG-98] - non-reproducible pom.xml
• [MGPG-99] - Passcode byte array provided to gpg executable on stdin is not terminated
• [MGPG-100] - Fix Temporary File Information Disclosure Vulnerability

New Feature

• [MGPG-106] - Introduce second signer implementation based on Bouncy Castle

Improvement

• [MGPG-101] - Switch to Junit5
• [MGPG-102] - Drop maven-artifact-transfer used by sign-and-deploy-file
• [MGPG-105] - Stop propagating bad practices; but allow for "compat mode"
• [MGPG-110] - The sign-and-deploy-file mojo POM validation is off

Task

• [MGPG-103] - Fix Windows CI
• [MGPG-107] - Settle on JUnit 5 assertions
• [MGPG-108] - Update plugin site doco

Dependency upgrade

• [MGPG-104] - Update to 3.9.6, drop the cruft, minimum baseline remains 3.2.5

---

What's Changed

• javadoc nits by @elharo in #51
• [MNG-6829] Replace StringUtils#isEmpty(String) and #isNotEmpty(String) by @timtebeek in #50
• Bump plexus-utils from 3.4.2 to 3.5.1 by @dependabot in #39
• [MGPG-101] Switch to JUnit 5 by @slachiewicz in #52
• Bump org.junit:junit-bom from 5.10.0 to 5.10.1 by @dependabot in #53
• Bump org.apache.maven.plugins:maven-invoker-plugin from 3.5.1 to 3.6.0 by @dependabot in #57
• Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 4.0.0 by @dependabot in #55
• Bump org.apache.maven.plugins:maven-plugins from 39 to 41 by @dependabot in #56
• Bump org.assertj:assertj-core from 3.24.2 to 3.25.2 by @dependabot in #62
• Bump org.junit:junit-bom from 5.10.1 to 5.10.2 by @dependabot in #63
• [MGPG-103] Fix Windows CI by @cstamas in #67
• [MGPG-104] Update to 3.9.6, drop the cruft, minimum baseline remains 3.2.5 by @cstamas in #68
• [MGPG-102] Drop MAT used in sign-and-deploy-file by @cstamas in #69
• [MGPG-107] Settle on JUnit 5 by @cstamas in #70
• [MGPG-105] Stop propagating bad practices by @cstamas in #71
• [MGPG-106] Introduce new signer: BC by @cstamas in #72
• Bump apache/maven-gh-actions-shared from 3 to 4 by @dependabot in #75
• [MGPG-105] Make possible backward compatibility by @cstamas in #74
• [MGPG-99] Make sure newline is added to input stream by @cstamas in #76
• [MGPG-110] SignAndDeployFileMojo validation is off by @cstamas in #78
• [MGPG-105] [MGPG-108] Make plugin backward compat and update site and doco by @cstamas in #77

New Contributors

• @timtebeek made their first contribution in #50
• @cstamas made their first contribution in #67

Full Changelog: maven-gpg-plugin-3.1.0...maven-gpg-plugin-3.2.0