From e26a28714db5e4efde9ab263da40af9a16cd6906 Mon Sep 17 00:00:00 2001 From: Josh Radcliff Date: Thu, 10 Sep 2026 15:12:48 -0400 Subject: [PATCH] chore(release): use GPG key from Secret Manager for signing --- .kokoro/release.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.kokoro/release.sh b/.kokoro/release.sh index 39efa03..c6be516 100755 --- a/.kokoro/release.sh +++ b/.kokoro/release.sh @@ -15,14 +15,16 @@ export PATH="${JAVA_HOME}/bin:${PATH}" # 1. Clean, Test, Sign, and Publish to Artifact Registry # Keyring / ADC handles authentication via the Kokoro BYOSA service account -# Keystore fetches the PGP signing key from Keystore config 74347 -KEYSTORE_GPG_FILE="${KOKORO_KEYSTORE_DIR:-}/74347_google_ads_java_gpg_secring" -if [[ -n "${KOKORO_KEYSTORE_DIR:-}" && -f "${KEYSTORE_GPG_FILE}" ]]; then - export SIGNING_KEY="$(cat "${KEYSTORE_GPG_FILE}")" +# Fetch the PGP signing key from Secret Manager (or fallback to SIGNING_KEY if already set) +if [[ -z "${SIGNING_KEY:-}" ]]; then + echo "=== Fetching GPG signing key from Secret Manager ===" + export SIGNING_KEY="$(gcloud secrets versions access latest \ + --secret="bam-devrel-maven-gpg-key" \ + --project="bam-devrel-releases")" fi if [[ -z "${SIGNING_KEY:-}" ]]; then - echo "ERROR: SIGNING_KEY is not set and Keystore GPG file is missing (${KEYSTORE_GPG_FILE})." >&2 + echo "ERROR: SIGNING_KEY is not set and could not be fetched from Secret Manager." >&2 exit 1 fi