Bug 560258 - Gpg sign checksums on new infra build

This reverts commit 37b25bfa6592df0e2ba10538b7bbb7d0d98ae931.

Change-Id: Ie1f0c5ff123f4466f25fb5a243e0e0d84d598039

5 files changed, 36 insertions, 11 deletions

diff --git a/JenkinsJobs/Builds/I-build.groovy b/JenkinsJobs/Builds/I-build.groovy
index db12be85a..c88d2e659 100644
--- a/JenkinsJobs/Builds/I-build.groovy
+++ b/JenkinsJobs/Builds/I-build.groovy
@@ -196,7 +196,6 @@ spec:
                             exit 1
                         fi
                         cd ${WORKSPACE}
-                        scp genie.releng@projects-storage.eclipse.org:/opt/public/hipp/homes/genie.releng/*.passphrase .
                     '''
                   }
                 }
@@ -300,6 +299,10 @@ spec:
             }
 		}
 	  stage('Gather Eclipse Parts'){
+	  environment {
+                KEYRING = credentials('secret-subkeys-releng.asc')
+                KEYRING_PASSPHRASE = credentials('secret-subkeys-releng.acs-passphrase')
+          }
           steps {
               container('jnlp') {
                   withEnv(["JAVA_HOME=${ tool 'openjdk-jdk11-latest' }"]) {
@@ -319,6 +322,10 @@ spec:
             }
 		}
 	  stage('Gather Equinox Parts'){
+	  environment {
+                KEYRING = credentials('secret-subkeys-releng.asc')
+                KEYRING_PASSPHRASE = credentials('secret-subkeys-releng.acs-passphrase')
+          }
           steps {
               container('jnlp') {
                   withEnv(["JAVA_HOME=${ tool 'openjdk-jdk11-latest' }"]) {
diff --git a/JenkinsJobs/Builds/Y-build.groovy b/JenkinsJobs/Builds/Y-build.groovy
index b1caec949..ace6f5e50 100644
--- a/JenkinsJobs/Builds/Y-build.groovy
+++ b/JenkinsJobs/Builds/Y-build.groovy
@@ -314,6 +314,10 @@ spec:
             }
 		}
 	  stage('Gather Eclipse Parts'){
+	  environment {
+                KEYRING = credentials('secret-subkeys-releng.asc')
+                KEYRING_PASSPHRASE = credentials('secret-subkeys-releng.acs-passphrase')
+          }
           steps {
               container('jnlp') {
                   withEnv(["JAVA_HOME=${ tool 'openjdk-jdk11-latest' }"]) {
@@ -333,6 +337,10 @@ spec:
             }
 		}
 	  stage('Gather Equinox Parts'){
+	  environment {
+                KEYRING = credentials('secret-subkeys-releng.asc')
+                KEYRING_PASSPHRASE = credentials('secret-subkeys-releng.acs-passphrase')
+          }
           steps {
               container('jnlp') {
                   withEnv(["JAVA_HOME=${ tool 'openjdk-jdk11-latest' }"]) {
diff --git a/cje-production/mbscripts/mb300_gatherEclipseParts.sh b/cje-production/mbscripts/mb300_gatherEclipseParts.sh
index 7711d52e8..a98e0c6ac 100755
--- a/cje-production/mbscripts/mb300_gatherEclipseParts.sh
+++ b/cje-production/mbscripts/mb300_gatherEclipseParts.sh
@@ -224,6 +224,13 @@ $JavaCMD -jar $LAUNCHER_JAR \
   verifyCompile
 popd
 
+#import gpg keys
+gpg --batch --import "${KEYRING}"
+for fpr in $(gpg --list-keys --with-colons  | awk -F: '/fpr:/ {print $10}' | sort -u);
+do
+  echo -e "5\ny\n" |  gpg --batch --command-fd 0 --expert --edit-key "${fpr}" trust;
+done
+
 # publish Eclipse
 pushd $CJE_ROOT
 ANT_SCRIPT=$ECLIPSE_BUILDER_DIR/eclipse/helper.xml
diff --git a/cje-production/mbscripts/mb310_gatherEquinoxParts.sh b/cje-production/mbscripts/mb310_gatherEquinoxParts.sh
index 9604a786c..f395b725d 100755
--- a/cje-production/mbscripts/mb310_gatherEquinoxParts.sh
+++ b/cje-production/mbscripts/mb310_gatherEquinoxParts.sh
@@ -51,6 +51,13 @@ if [ -d $REPO_DIR ]; then
   popd
 fi
 
+#import gpg keys
+gpg --batch --import "${KEYRING}"
+for fpr in $(gpg --list-keys --with-colons  | awk -F: '/fpr:/ {print $10}' | sort -u);
+do
+  echo -e "5\ny\n" |  gpg --batch --command-fd 0 --expert --edit-key "${fpr}" trust;
+done
+
 # publish Equinox
 pushd $CJE_ROOT
 mkdir -p $ECLIPSE_BUILDER_DIR/equinox/$TMP_DIR
diff --git a/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh b/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh
index 4aeed03d1..d0a76f31e 100755
--- a/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh
+++ b/eclipse.platform.releng.tychoeclipsebuilder/eclipse/extras/produceChecksum.sh
@@ -109,18 +109,14 @@ done
 echo "[DEBUG] Producing GPG signatures starting."
 # We make double use of the "client". One to simplify signing script. Second to identify times in timefile.
 # remember, this "WORKSPACE" is for genie.releng for production builds.
-key_passphrase_file=${key_passphrase_file:-${WORKSPACE}/${client}-dev.passphrase}
-if [[ -r $key_passphrase_file ]]
+if [ ! -z "${KEYRING_PASSPHRASE}" ]
 then
-  signer=${signer:-${client}-dev@eclipse.org}
-  signature_file512=${allCheckSumsSHA512}.asc
-  fileToSign512=${allCheckSumsSHA512}
-
-  cat ${key_passphrase_file} | gpg --local-user ${signer} --sign --armor --output ${signature_file512} --batch --yes --passphrase-fd 0 --detach-sig ${fileToSign512}
+    signature_file512=${allCheckSumsSHA512}.asc
+    gpg --detach-sign --armor --output ${signature_file512} --batch --yes --passphrase-fd 0 ${allCheckSumsSHA512} <<< "${KEYRING_PASSPHRASE}"
 else
-  # We don't treat as ERROR since would be normal in a "local build".
-  # But, would be an ERROR in production build so could be improved.
-  echo -e "\n\t[WARNING] The key_passphrase_file did not exist or was not readable.\n"
+    # We don't treat as ERROR since would be normal in a "local build".
+    # But, would be an ERROR in production build so could be improved.
+    echo -e "\n\t[WARNING] The key_passphrase_file did not exist or was not readable.\n"
 fi
 # if SCRIPT_PATH not defined, we can not call elapsed time
 if [[ -n "${SCRIPT_PATH}" ]]