= Signing

Signing ensures that the artifacts have been generated by yourself and your users can verify that by comparing the
generated signature with your public signing key.

JReleaser can sign all files, including distribution archives and any extra files attached to the project. This section
must be configured if you intent to sign commits as well.

Use the following options to customize how files may be signed:

include::partial$legend.adoc[]

[tabs]
====
YAML::
+
[source,yaml]
[subs="+macros"]
----
# icon:dot-circle[]
signing:
  # Enables or disables file signing.
  # Valid values are [`NEVER`, `ALWAYS`, `RELEASE`, `SNAPSHOT`].
  # Defaults to `NEVER`.
  # icon:dot-circle[]
  active: ALWAYS

  # Generates an armored signature.
  # Defaults to `true`.
  # icon:dot-circle[]
  armored: true

  # How should GPG keys be handled.
  # Valid values are [`MEMORY`, `FILE`].
  # Defaults to `MEMORY`.
  # icon:dot-circle[]
  mode: MEMORY

  # The public GPG (ascii armored) used to sign files and commits.
  # If left unspecified, the `JRELEASER_GPG_PUBLIC_KEY`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  publicKey: __DO_NOT_SET_HERE__

  # The private GPG (ascii armored) used to sign files and commits.
  # If left unspecified, the `JRELEASER_GPG_SECRET_KEY`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  secretKey: __DO_NOT_SET_HERE__

  # The passphrase required to read secret keys.
  # If left unspecified, the `JRELEASER_GPG_PASSPHRASE`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  passphrase: __DO_NOT_SET_HERE__
----
TOML::
+
[source,toml]
[subs="+macros"]
----
# icon:dot-circle[]
[signing]
  # Enables or disables file signing.
  # Valid values are [`NEVER`, `ALWAYS`, `RELEASE`, `SNAPSHOT`].
  # Defaults to `NEVER`.
  # icon:dot-circle[]
  active = "ALWAYS"

  # Generates an armored signature.
  # Defaults to `true`.
  # icon:dot-circle[]
  armored = true

  # How should GPG keys be handled.
  # Valid values are [`MEMORY`, `FILE`].
  # Defaults to `MEMORY`.
  # icon:dot-circle[]
  mode = 'MEMORY'

  # The public GPG (ascii armored) used to sign files and commits.
  # If left unspecified, the `JRELEASER_GPG_PUBLIC_KEY`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  publicKey = "__DO_NOT_SET_HERE__"

  # The private GPG (ascii armored) used to sign files and commits.
  # If left unspecified, the `JRELEASER_GPG_SECRET_KEY`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  secretKey = "__DO_NOT_SET_HERE__"

  # The passphrase required to read secret keys.
  # If left unspecified, the `JRELEASER_GPG_PASSPHRASE`
  # environment variable must be defined.
  # icon:exclamation-triangle[] icon:eye-slash[]
  passphrase = "__DO_NOT_SET_HERE__"
----
JSON::
+
[source,json]
[subs="+macros"]
----
{
  // icon:dot-circle[]
  "signing": {
    // Valid values are [`NEVER`, `ALWAYS`, `RELEASE`, `SNAPSHOT`].
    // Defaults to `NEVER`.
    // icon:dot-circle[]
    "active": "ALWAYS",

    // Generates an armored signature.
    // Defaults to `true`.
    // icon:dot-circle[]
    "armored": true,

    // How should GPG keys be handled.
    // Valid values are [`MEMORY`, `FILE`].
    // Defaults to `MEMORY`.
    // icon:dot-circle[]
    "mode": "MEMORY",

    // The public GPG (ascii armored) used to sign files and commits.
    // If left unspecified, the `JRELEASER_GPG_PUBLIC_KEY`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    "publicKey": "__DO_NOT_SET_HERE__",

    // The private GPG (ascii armored) used to sign files and commits.
    // If left unspecified, the `JRELEASER_GPG_SECRET_KEY`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    "secretKey": "__DO_NOT_SET_HERE__",

    // The passphrase required to read secret keys.
    // If left unspecified, the `JRELEASER_GPG_PASSPHRASE`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    "passphrase": "__DO_NOT_SET_HERE__"
  }
}
----
Maven::
+
[source,xml]
[subs="+macros,verbatim"]
----
<jreleaser>
  <!--
    icon:dot-circle[]
  -->
  <signing>

    <!--
      Enables or disables file signing.
      Valid values are [`NEVER`, `ALWAYS`, `RELEASE`, `SNAPSHOT`].
      Defaults to `NEVER`.
      icon:dot-circle[]
    -->
    <active>ALWAYS</active>

    <!--
      Generates an armored signature.
      Defaults to `true`.
      icon:dot-circle[]
    -->
    <armored>true</armored>

    <!--
      How should GPG keys be handled.
      Valid values are [`MEMORY`, `FILE`].
      Defaults to `MEMORY`.
      icon:dot-circle[]
    -->
    <mode>MEMORY</mode>

    <!--
      The public GPG (ascii armored) used to sign files and commits.
      If left unspecified, the `JRELEASER_GPG_PUBLIC_KEY`
      environment variable must be defined.
      icon:exclamation-triangle[] icon:eye-slash[]
    -->
    <publicKey>__DO_NOT_SET_HERE__</publicKey>

    <!--
      The private GPG (ascii armored) used to sign files and commits.
      If left unspecified, the `JRELEASER_GPG_SECRET_KEY`
      environment variable must be defined.
      icon:exclamation-triangle[] icon:eye-slash[]
    -->
    <secretKey>__DO_NOT_SET_HERE__</secretKey>

    <!--
      The passphrase required to read secret keys.
      If left unspecified, the `JRELEASER_GPG_PASSPHRASE`
      environment variable must be defined.
      icon:exclamation-triangle[] icon:eye-slash[]
    -->  
    <passphrase>__DO_NOT_SET_HERE__</passphrase>
  </signing>
</jreleaser>
----
Gradle::
+
[source,groovy]
[subs="+macros"]
----
jreleaser {
  // icon:dot-circle[]
  signing {
    // Enables or disables file signing.
    // Valid values are [`NEVER`, `ALWAYS`, `RELEASE`, `SNAPSHOT`].
    // Defaults to `NEVER`.
    // icon:dot-circle[]
    active = "ALWAYS"

    // Generates an armored signature.
    // Defaults to `true`.
    // icon:dot-circle[]
    armored = true

    // How should GPG keys be handled.
    // Valid values are [`MEMORY`, `FILE`].
    // Defaults to `MEMORY`.
    // icon:dot-circle[]
    mode = 'MEMORY'

    // The public GPG (ascii armored) used to sign files and commits.
    // If left unspecified, the `JRELEASER_GPG_PUBLIC_KEY`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    publicKey = '__DO_NOT_SET_HERE__'

    // The private GPG (ascii armored) used to sign files and commits.
    // If left unspecified, the `JRELEASER_GPG_SECRET_KEY`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    secretKey = '__DO_NOT_SET_HERE__'

    // The passphrase required to read secret keys.
    // If left unspecified, the `JRELEASER_GPG_PASSPHRASE`
    // environment variable must be defined.
    // icon:exclamation-triangle[] icon:eye-slash[]
    passphrase = '__DO_NOT_SET_HERE__'
  }
}
----
====

WARNING: Prefer the use of xref:configuration:environment.adoc[] if the configuration is stored at a public repository.

== Mode

When the mode is set to `MEMORY` (the default) then the values of `JRELEASER_GPG_PUBLIC_KEY` and
`JRELEASER_GPG_SECRET_KEY` are treated as the actual contents for each key.

When the mode is set to `FILE` then the values of `JRELEASER_GPG_PUBLIC_KEY` and
`JRELEASER_GPG_SECRET_KEY` are treated as file paths pointing to files that the keys.

