Travis: gpg: signing failed: secret key not available - maven

Question

I try to deploy my opensource project to Nexus Repository (https://oss.sonatype.org) using the travis ci, but unfortunately travis doesn't found the secret key for gpg signed step.
I follow all steps on https://github.com/making/travis-ci-maven-deploy-skelton but the release deploy continuous doesn't work. At my workspace all works correctly and I can deploy releases to Nexus Repository.
I'm using one script to deploy the project:
#!/usr/bin/env bash
echo "Checking the current branch..."
if [ "$TRAVIS_BRANCH" = 'master' ] && [ "$TRAVIS_PULL_REQUEST" == 'false' ]; then
echo "The current branch is: master"
echo "Run maven deploy parameter using sign and build-extras profiles..."
mvn deploy -P sign,build-extras --settings setting-maven.xml
fi

Answer 1

Such issues commonly occur if the service is running under another user than the developer's account. GnuPG has per-user "GnuPG home directories" in ~/.gnupg. Make sure to import the keys under the service's user (run this command from your developer account):
gpg --export-secret-keys [key-id] | sudo -u [service user] gpg --import
Alternatively, you could use gpg's --homedir option to change to GnuPG home directory location, but be aware GnuPG is very picky about properly set, tight permissions by default (which is a good thing).

Answer 2

The solution in https://github.com/making/travis-ci-maven-deploy-skelton relies on symmetrically encrypted keyrings in your $GPG_DIR. In the sample that would be the folder deploy.
To create these keyrings, you do this (copied):
$ export ENCRYPTION_PASSWORD=<password to encrypt>
$ openssl aes-256-cbc -pass pass:$ENCRYPTION_PASSWORD -in ~/.gnupg/secring.gpg -out deploy/secring.gpg.enc
$ openssl aes-256-cbc -pass pass:$ENCRYPTION_PASSWORD -in ~/.gnupg/pubring.gpg -out deploy/pubring.gpg.enc
This creates the encrypted keyrings in the folder deploy. You probably need to create the folder before you run the openssl commands.
Both encrypted keyrings need to be checked in, so that they are available as part of the project at build-time.
At build-time you need to decrypt the keyrings. You do this by adding something like this to your .travis.yml file:
before_install:
- openssl aes-256-cbc -pass pass:$ENCRYPTION_PASSWORD -in $GPG_DIR/pubring.gpg.enc -out $GPG_DIR/pubring.gpg -d
- openssl aes-256-cbc -pass pass:$ENCRYPTION_PASSWORD -in $GPG_DIR/secring.gpg.enc -out $GPG_DIR/secring.gpg -d
Note, how the openssl command uses $GPG_DIR? That's basically your deploy directory. To make sure Travis knows about $GPG_DIR, define it, e.g. like this:
env:
global:
- GPG_DIR="`pwd`/deploy"
So basically Travis now knows how to decrypt your GPG keyrings and puts them into a defined location. Now you still have to tell GPG how to pick it up. For that you have two options:
Properties in your pom.xml or
properties in your settings.xml
The project https://github.com/making/travis-ci-maven-deploy-skelton uses the first option (pom.xml). The essential part is:
<profiles>
<profile>
<id>ossrh</id>
<properties>
<gpg.executable>gpg</gpg.executable>
<gpg.keyname>${env.GPG_KEYNAME}</gpg.keyname>
<gpg.passphrase>${env.GPG_PASSPHRASE}</gpg.passphrase>
<!-- tell gpg to NOT use the default keyring from the current user's home -->
<gpg.defaultKeyring>false</gpg.defaultKeyring>
<!-- instead tell gpg to use the keyrings from your GPG_DIR -->
<gpg.publicKeyring>${env.GPG_DIR}/pubring.gpg</gpg.publicKeyring>
<gpg.secretKeyring>${env.GPG_DIR}/secring.gpg</gpg.secretKeyring>
</properties>
[...]
With these properties you define parameters for the gpg executable. This works, because you have set up $GPG_DIR in your .travis.yml file.
In essence you tell gpg to not use the standard keyrings in the current user's home directory, but instead the keyrings you've just decrypted and stuck into your $GPG_DIR.
You may ask yourself where the other <properties>/env variables come from. They are appended to your .travis.yml when running the following commands:
$ travis encrypt --add -r <username>/<repository> SONATYPE_USERNAME=<sonatype username>
$ travis encrypt --add -r <username>/<repository> SONATYPE_PASSWORD=<sonatype password>
$ travis encrypt --add -r <username>/<repository> ENCRYPTION_PASSWORD=<password to encrypt>
$ travis encrypt --add -r <username>/<repository> GPG_KEYNAME=<gpg keyname (ex. 1C06698F)>
$ travis encrypt --add -r <username>/<repository> GPG_PASSPHRASE=<gpg passphrase>
<username> is your Github username and <repository> your Github repo.
After running the travis encrypt --add commands, your .travis.yml file will have appended entries like this:
env:
global:
- GPG_DIR="`pwd`/deploy"
- secure: VYxU+0zMoKExcopJ8z74Pd5KE6TnoP72hZchnpy+gxLVrt4d5lBJ042xT2D/4qebG8stHpq5DtYO8EQaZVMKVQl48fXwQk4aWiY0OWNY2Pz63Y9IFDGX0n/B1NPxbPToCoXHsddGvAVOlRXbDTfkF+yc3nheaLLnjhxFAM9X0/e1/bqnFyrwqrJmenG7RaGclsscjLPLExTAy+jIbj59loZkclVfKpMS98Ol605Xpmn6VTxr8Z7k3FEQ4mt3VI350QKBbmMsiEWpVAbPVPWsUkEYpM5VuU7Pi1W5fbaJBxIlOAdKjDtYfUvyY63iQK79787dBrGM5T2FDUV05UXpi4NvKnrcdkhuOFlXB4Io3qroen1lrh5igBdIlYc4kBpvDMpnewIuM7F+5fPS9XgBZIlOkiAEPqInr0sonlj4c+vkd92PeujDYiKUCA2uVLEzLYAAu7oC6O5K18JBzLurKNAda+9f+XuQrc1t140u8jic9YF7oM7fUdiu1MJ6j9WMiu3Syh9yjAOC+5RaBxy/ZcDUmYazH/oQNe3d55AMKYOdsryF51W/WfSrHoHtKUGsy9RsDvY690GU6XZ+Zev79nRKs9uVSqqlcGv+YPoB3zlDjmks51fm0HovgWWsCDbDgP4/FXPFKzr0Ht6qnYjJ=
- secure: Wl1/oERtbz739uq+cfHQdpXGC/ZIX1l9HBihyTSt0qta7HlqQeCHtCQfpbq92BYj518CZjNl3ijXlYaXOoW4Z1L2VGzJwxNVdiG2XVkUrXfTO6i711Q/f6ezINlDhRhH+Sn1GhFPB8x7i5vnlqSvMqG19x2mfPsD50yi/58elU7t3zUg5HnBpHfyCdrlaa1pI/sHYIog4Y/Nm3H6/9WDu5ErnhmSKT9LCHdXDXn8AO8UfQXP/eMHUAMdnn8LP/+HtGXmI1Jij9UFaB1PTMyKRCMiVizMDgMqtjXhzBqg8Wqy6pp2yicSEn4JVgBM26vsNQwHXgz3kut4FwlY7Aph8Mx61jU8OvVh/vD6y1gm7r7PW4lcy1PT3pTtfL2XLH3p0/cl+WqHJIfupyOZg/z0dEd0JKJAxJ7XR3y6Z0QVTKe0QTSOO8O5g+EfuyoJFC4d28G8gM+Zc1OctpXOMrU0l4x3PDrb8xoxugsUMpYfUIQl7L9Dxr6PqHbDIgNM/5N5L3ZwWiI12fKtIqfurVJ2jsA9ahzCskzRSK745lwIPrpw6NVPjN8CzbTWZjyR9aMuxpHO+ptMmXxjo3asA7tJQDBtfbAWWz0FGro429UK3IWa5dgtVQpP2GG4/VWtUM1CUhG9x74FpojIHa4EzpLji=
[...]
These secure entries are translated to environment variables by Travis at build-time.
A couple more remarks:
By default Travis uses gpg version 1. Because of issues with entering passphrases via loopback in gpg 2.0, version 1 is preferred. Once Travis supports gpg 2.2, this may change.
If you haven't done so yet, you need to publish your key to
http://keys.gnupg.net:11371
http://keyserver.ubuntu.com:11371
http://pool.sks-keyservers.net:11371
Good luck.