From mobile apps to microservices, from small startups to big enterprises, Gradle helps teams build, automate and deliver better software, faster.

Gradle Community

Hello peeps, I got a request of <https://github.com/gmazzo/gradle-buildconfig-plugin/issues/214|adding GPG-signature to one of my plugins> to support <https://docs.gradle.org/current/userguide/dependency_verification.html|Dependencies Verification>.

After a bit of research/discussion (and after adding `singing` plugin to the project), we end up concluding the `Plugin Portal` is somehow ignoring `.asc` files, they <https://plugins.gradle.org/m2/io/github/gmazzo/codeowners/io.github.gmazzo.codeowners.gradle.plugin/2.4.1/|are not there when requested by URL>. Which is not the case <https://repo.maven.apache.org/maven2/io/github/gmazzo/codeowners/io.github.gmazzo.codeowners.gradle.plugin/2.4.1/|for Maven Central's URL>.

Does anyone knows if this an intentional behavior of Plugins Portal, or a bug?

The only workaround I foresee will be to also publish the plugin to Maven Central, and ask the consumer to target Maven Central before Plugins Portal when resolving plugins

You could also just publish to Maven Central.

It will probably not even break anyone's workflow because the plugin portal proxies Maven Central

That's try, I'll loose the entry (or get outdated) in Plugins Portal, but yes

I wanted to confirm if some else has already faced this, to see if I should report it to Gradle team

I'd love the plugin portal to be for metadata only: <https://github.com/gradle/plugin-portal-requests/issues/225>

For hosting, Maven Central has a bunch of benefits

According to the comment at <https://github.com/gradle/plugin-portal-requests/issues/211#issuecomment-1948041280> I'd say you might do something wrong, or something broke in the meantime.
But there it worked to upload the signature files to plugin portal.

Also the docs of the plugin publish plugin tell that all you have to do since version 1.0.0 of the plugin is also applying the `signing` plugin and the plugin and marker artifacts will automatically be signed and signatures uploaded

<https://plugins.gradle.org/docs/publish-plugin>

&gt; I'd say you might do something wrong, or something broke in the meantime.
After publishing (with the same artifacts configuration) on Maven Central, it started to work :man-shrugging:

I'd be nice to have an official word on this

For that you might need to open an issue in the portal requests tracker