Checksums and signing

Shared preparation validates retained MD5, SHA-1, SHA-256 and SHA-512 checksums and completes absent checksums for primary publication files and retained native snapshot metadata. Valid existing bytes are preserved. Malformed or mismatching checksums, orphan sidecars and destination collisions fail. It does not perform full Central admission validation or cryptographic verification of signatures.

By default, every primary file (including POM and emitted .module) must have a nonempty signature. Existing signatures are preserved. Missing-signature generation is off by default; when enabled, only absent primary signatures are generated. An existing empty signature fails the presence policy and is not repaired. Existing signature checksums are checked and retained, but no new checksums of signatures, recursive sidecars or signatures of checksums/snapshot metadata are generated.

Policy precedence is explicit preparation option > project property > settings convention. Project properties accept only true or false, case-insensitively. Only :prepareAtrMavenBundle accepts the Boolean options and their inverse forms:

1# Unsigned output, using one policy for every requested creator.
2./gradlew -PatrMavenBundle.requireSignatures=false :atrCentralArchive :atrNjordFiles
3
4# Equivalent task options; disabling generation is a separate choice.
5./gradlew :prepareAtrMavenBundle --no-require-signatures --no-sign-missing :atrCentralArchive :atrNjordFiles
6
7# Generate missing signatures once, then require them for both archives.
8./gradlew :prepareAtrMavenBundle --sign-missing :atrCentralArchive :atrNjordArchive

Settings can opt out with requireSignatures.set(false) and can enable generation with signMissing.set(true). The project properties are atrMavenBundle.requireSignatures and atrMavenBundle.signMissing. Creator and lifecycle tasks reject preparation options; put options immediately after the preparation task as shown.

Root signing

Generation uses the root project’s public Gradle signing configuration. The plugin applies root signing but creates no native per-publication Sign tasks. For Kotlin DSL signing accessors, explicitly declare signing in the root project too. One possible configuration uses the normal Gradle in-memory signer:

1plugins { signing }
2signing {
3    useInMemoryPgpKeys(
4        providers.gradleProperty("signingKey").orNull,
5        providers.gradleProperty("signingPassword").orNull,
6    )
7}

Supply signing material using your normal local Gradle practices. Gradle’s other root signing configurations, including useGpgCmd(), can also provide the signatory; GPG agent, hardware and keyring setup remain user-managed. A signer is required only when a requested preparation actually needs to generate a missing signature. Already-present signatures require no signer even when signMissing=true. Missing files are signed individually, so hardware signing may require one touch per primary. A preparation that runs again can sign again; configuration-cache reuse does not promise skipped signing or reproducible new signature bytes. The plugin never imports keys or configures a keyring.

Disabling generation also prevents input snapshotting from inspecting the configured signer’s key identity. When generation is enabled, Gradle can inspect a configured signer while evaluating task inputs, even if native signatures are already present.

Common failures

See configuration for settings and exclusions.