From 75d9bd66c2f83c64a9c3483e00433d282d85d228 Mon Sep 17 00:00:00 2001 From: Klaas Schuijtemaker Date: Tue, 18 Aug 2026 08:49:48 +0200 Subject: [PATCH] Fix backend publish: tolerate whitespace/armored SIGNING_KEY when decoding The publish step failed with 'bad character in base64 value' while decoding the SIGNING_KEY secret. Handle both an already ASCII-armored key and a line-wrapped base64 value by stripping whitespace before decodeBase64(). Same fix as publictask-plugin 3954820. --- gradle/publishing.gradle | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/gradle/publishing.gradle b/gradle/publishing.gradle index da4d618..0152bf9 100644 --- a/gradle/publishing.gradle +++ b/gradle/publishing.gradle @@ -96,9 +96,17 @@ centralPortalPlus { if (signingConfigSet) { signing { - def signingKeyBase64 = System.getenv("SIGNING_KEY") - def signingKeyBytes = signingKeyBase64.decodeBase64() - def signingKey = new String(signingKeyBytes, "UTF-8") + def rawSigningKey = System.getenv("SIGNING_KEY") + // The SIGNING_KEY secret may be provided either as an ASCII-armored PGP key directly, or as a + // base64-encoded armored key. Base64 produced by tools such as `base64`/`gpg --export` is often + // line-wrapped, and Groovy's decodeBase64() rejects whitespace with "bad character in base64 value". + // Detect an already-armored key and otherwise strip whitespace before decoding. + def signingKey + if (rawSigningKey.contains("-----BEGIN")) { + signingKey = rawSigningKey + } else { + signingKey = new String(rawSigningKey.replaceAll("\\s", "").decodeBase64(), "UTF-8") + } def signingKeyPassword = System.getenv('SIGNING_KEY_PASSWORD') useInMemoryPgpKeys(signingKey, signingKeyPassword)