[DRAFT] Some rudimentary version of how releasing could work

[jrudolph]

Here are some ideas how releasing could later work. It's far from finished.

In this setup, a docker image provides the base installation to use for building.

GPG keys are provided from the outside of the container by providing access to the host gpg-agent. Alternatively, we could provide keys similarly as sbt-ci-release does it by actually providing the secret as an environment value. Both options don't seem super compelling. The use of gpg-agent at least provides the possibility to also use smartcards/yubikeys for signing automatically.

The setup of gpg-agent propagation to the docker container is right now quite brittle:

• it requires that the user id must match between host and container
• it assumes a certain setup of how gpg-agent is connected that works on Ubuntu/Linux but might not work on other distros

[seveneves]

Is this a real signing key?

[jrudolph]

This is a real id of an example key.

[pjfanning]

newer versions (that already exist, but not yet uptaken here) produce the sha digests automatically

[mdedetrich]

I will make a PR to update version now.

[mdedetrich]

So the PR has been merged (see #195) so you don't need to worry about manually creating digests of the files.

[mdedetrich]

nit: new line here

[mdedetrich]

GPG keys are provided from the outside of the container by providing access to the host gpg-agent. Alternatively, we could provide keys similarly as sbt-ci-release does it by actually providing the secret as an environment value. Both options don't seem super compelling. The use of gpg-agent at least provides the possibility to also use smartcards/yubikeys for signing automatically.

This is more of a long term idea, but I always imagined using sbt-pgp directly rather than sbt-ci-release since sbt-pgp just wraps over gpg so there is no reason why it should have the same problems as sbt-ci-release. In fact I think in general sbt-ci-release is not really needed for pekko projects, the only functionality we use from it is sbt-dynver especially considering there is broad agreement on how to do a proper release which is not going to be via pushing a git tag.