ci: sign fat jars (.asc) + cross-repo byte-identical shared files - #359
Merged
bernardladenthin merged 4 commits intoJul 24, 2026
Merged
Conversation
The all-backends server fat jars (jar-with-dependencies) were attached to the GitHub Release / snapshot pre-release with only a .sha256 checksum — no signature, unlike the thin jars (which maven-gpg signs at deploy) and unlike the BAF / srcmorph sibling fat jars. Add .github/sign-fatjars.sh (imports the release key into an ephemeral keyring and produces a detached, armored .asc for every *-jar-with-dependencies*.jar in a directory, verifying each) and call it from github-release-signed and github-snapshot after they download llama-fatjars, before the upload. Both jobs now declare environment: maven-central (where GPG_PRIVATE_KEY/GPG_PASSPHRASE are scoped; it has no approval gate) and check out the repo so the script is present. The .sha256 files are kept (integrity); the .asc adds authenticity. Signed in these dispatch-gated attach jobs, not in package-fatjars, because only this path receives the key. Verified locally end-to-end with a throwaway key: both fat jars signed + verified, the thin jar left untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
…script Neutralize the header (repo-agnostic) and relicense to MIT OR Apache-2.0 so the exact same sign-fatjars.sh can live byte-identical in java-llama.cpp and srcmorph (same pattern as the verify-signing-key job). Signing logic is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
…cross-repo) Unify the throwaway signing-selftest Gradle project (build.gradle.kts + settings.gradle.kts) to the dual SPDX-License-Identifier "MIT OR Apache-2.0" so the files are TRULY byte-identical across all four sibling repos (java-llama.cpp used MIT, the others Apache-2.0 — same body, only the header drifted). This matches the cross-repo-synced-file convention already used for sign-fatjars.sh and makes the verify-signing-key-gradle preflight project checksum-verifiable via workspace. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
…al cross-repo) Sync lombok.config to the canonical workspace policy content verbatim The three Lombok repos had IDENTICAL directives but drifted comments (per-repo rationale in the file). Replace each with the canonical block from workspace/policies/lombok-config.md verbatim, so the file is now byte-identical across all three (the rationale lives once in the policy / crossrepo, not in the file). Recorded in the workspace cross-repo checksum drift-check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
bernardladenthin
had a problem deploying
to
maven-central
July 24, 2026 06:25 — with 
GitHub Actions
Failure
GitHub Actions
Failure
bernardladenthin
had a problem deploying
to
startgate
July 24, 2026 06:25 — with
GitHub Actions
Error
GitHub Actions
Error
bernardladenthin
had a problem deploying
to
maven-central
July 24, 2026 06:25 — with
GitHub Actions
Failure
GitHub Actions
Failure
|
bernardladenthin
deleted the
claude/bitcoinaddressfinder-jar-upload-k0tkj7
branch
July 24, 2026 06:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.asc) on the GitHub Release / snapshot pre-release: new.github/sign-fatjars.sh(ephemeral keyring, detached armored signature + verify) is called fromgithub-release-signed/github-snapshotafter they downloadllama-fatjars. Both jobs now declareenvironment: maven-central(where the key is scoped; no approval gate) andcheckoutthe repo..sha256(integrity) is kept;.ascadds authenticity — parity with the thin jars and the BAF/srcmorph siblings.sign-fatjars.shis a byte-identical cross-repo shared script (dualMIT OR Apache-2.0), shared with srcmorph..github/signing-selftest/(build.gradle.kts+settings.gradle.kts) toMIT OR Apache-2.0so the throwawayverify-signing-key-gradleproject is truly byte-identical across all four repos (previously the body matched but the SPDX header drifted).llama/lombok.configto the canonicalworkspace/policies/lombok-config.mdblock verbatim (directives were already identical; only comment rationale drifted).CI-config / docs only — no production code, no C++/JNI changes. Fat-jar signing runs only on the dispatch-gated publish path (
publish_to_central=true).Test plan
sign-fatjars.shverified end-to-end locally with a throwaway key (both fat jars signed + verified, thin jar untouched)Related issues / PRs
Coordinated cross-repo change; the canonical docs + the checksum drift-check table land in the workspace PR (same branch name). Sibling PRs: BitcoinAddressFinder / srcmorph / streambuffer / workspace.
Checklist
🤖 Generated with Claude Code
https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
Generated by Claude Code