GPG-Signing of maven artifacts fails on Windows runners with actions/checkout@v4 and maven-gpg-plugin v3.2.4

[ralfkonrad]

Description:
GPG-Signing of maven artifacts fails only on Windows runners using actions/checkout@v4 and the updated maven-gpg-plugin v3.2.0-v3.2.4. However, the previous plugin version v3.1.0 does not cause any problems for no runner.

The error is gpg: signing failed: Bad passphrase, see e.g. here.

However, the new plugin versions v3.2.x work on my local windows 10 machine.

The GPG private key and passphrase provided as secrets obviously work for the old plugin on windows and the new one on ubuntu and macOS.

I'm aware that this is perhaps not (only) an error in this action but perhaps in the maven-gpg-plugin or in the interaction between them.

Task version:
actions/checkout@v4

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:
Here is a repository test-mvn-gpg-plugin which reproduces the error in this workflow build-and-sign.

Expected behavior:
The GPG-signing is successful for all runners.

Actual behavior:
The GPG-signing fails for windows-2019 and windows-2022 runners.

[aparnajyothi-y]

Hello @ralfkonrad, Thank you for creating this issue and we will look into it :)

[mahabaleshwars]

Hello @ralfkonrad, the issue is arising from changes made in the 3.2.0 version of the Apache Maven GPG Plugin. As for the setup-java in connection with the maven-gpg-plugin, it's functioning as expected. We suggest you to report a bug with the Apache Maven GPG Plugin to address this.