You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fyi @anatoliykmetyuk... wanted to make sure this is on your radar, as getting this upgrade through would unlock the possibility for a large number of OSS projects under the Typelevel umbrella to move to sbt 2
sbt-gpg has been unmaintained for 8 years and I'm a bit surprised that sbt-typelevel even uses it. have alternatives been considered? sbt-ci-release uses sbt-pgp. (before you ask, I don't know what the difference is...)
oh, I see that at one point @jodersky revived it at https://github.com/jodersky/sbt-gpg , and I think that's the one you're depending on? but that one has no commits in 5 years
(before you ask, I don't know what the difference is...)
The original flavor sbt-pgp, written by Josh circa Typesafe days, generally had the philosophy that JVM should stand on its own (partly to accommodate macOS vs Windows) so it adopted Java-based Bouncy Castle library as its main engine, with the alternative to use CLI GnuPG (gpg).
In the ensuing years, cloud-based CI became common, and Bouncy Castle lagged behind the command-line GnuPG. sbt-gpg was created as a lightweight alternative that delegates all operations to command-line GnuPG. This meant that it would require gpg installed on the machine, but for projects that automate publishing from the CI, or Daniel Spiewak with YubiKeys, relying on gpg made more sense.
At some point, I took over the development of sbt-pgp and released sbt-pgp 2.0.0 (https://github.com/sbt/sbt-pgp/releases/tag/v2.0.0), which flipped useGpg to true and incorporated other ideas from sbt-gpg, like using credentials to specify the signing key with Daniel's blessing. The intent here was to migrate the existing sbt-pgp users to the GnuPG CLI world. So for sbt-pgp 2.x, there shouldn't be much difference between sbt-gpg.
Reacted by Rikito Taniguchi, Seth Tisue, Jacob Wang, Zainab Ali and Eshu
The code for sbt-gpg is a minimal wrapper over publish. Looking through the OSS repositories using sbt-typelevel, it doesn't appear to be customized downstream (gpg* settings aren't configured anywhere).
We could probably transition from sbt-gpg with sbt-pgp without major user-facing API changes. One difference is that sbt-pgp introduces a new publishSigned task, while sbt-gpg rewrites publish. I'm exploring the differences in a branch here.
Reacted by Maksym Ochenashko, Luka Jacobowitz, Seth Tisue and Tobias Roland
I'm exploring moving to sbt-projectmatrix in #918. With that said, sbt-crossproject has just been released with SBT 2 support. We should hopefully be able to treat it as a separate upgrade.
I've managed to get sbt typelevel to build with itself on SBT 2, as well as some basic typelevel projects. The code lives in a cross-build-all-plugins branch. It requires a local snapshot of SBT for sbt/sbt#9674, as well as a local snapshot of Laika for typelevel/Laika#774.
Reacted by Luka Jacobowitz, Marco Zühlke, Arman Bilge, Hugo van Rijswijk, Maksym Ochenashko and Matej Cerny
I've a local snapshot working on discipline and scalacheck. This uses a snapshot version of Laika, but everything else is on released versions. If anyone else wants to try it out, I've an evolving migration guide.
Activity
SethTisue commentedon Jun 25, 2026
fyi @anatoliykmetyuk... wanted to make sure this is on your radar, as getting this upgrade through would unlock the possibility for a large number of OSS projects under the Typelevel umbrella to move to sbt 2
@eed3si9n and @tanishiking are aware but I'll @ them anyway :-)
SethTisue commentedon Jun 25, 2026
sbt-gpg has been unmaintained for 8 years and I'm a bit surprised that sbt-typelevel even uses it. have alternatives been considered? sbt-ci-release uses sbt-pgp. (before you ask, I don't know what the difference is...)
oh, I see that at one point @jodersky revived it at https://github.com/jodersky/sbt-gpg , and I think that's the one you're depending on? but that one has no commits in 5 years
eed3si9n commentedon Jun 25, 2026
The original flavor sbt-pgp, written by Josh circa Typesafe days, generally had the philosophy that JVM should stand on its own (partly to accommodate macOS vs Windows) so it adopted Java-based Bouncy Castle library as its main engine, with the alternative to use CLI GnuPG (gpg).
In the ensuing years, cloud-based CI became common, and Bouncy Castle lagged behind the command-line GnuPG. sbt-gpg was created as a lightweight alternative that delegates all operations to command-line GnuPG. This meant that it would require
gpginstalled on the machine, but for projects that automate publishing from the CI, or Daniel Spiewak with YubiKeys, relying ongpgmade more sense.At some point, I took over the development of sbt-pgp and released sbt-pgp 2.0.0 (https://github.com/sbt/sbt-pgp/releases/tag/v2.0.0), which flipped
useGpgtotrueand incorporated other ideas from sbt-gpg, like usingcredentialsto specify the signing key with Daniel's blessing. The intent here was to migrate the existing sbt-pgp users to the GnuPG CLI world. So for sbt-pgp 2.x, there shouldn't be much difference between sbt-gpg.zainab-ali commentedon Jul 13, 2026
The code for
sbt-gpgis a minimal wrapper overpublish. Looking through the OSS repositories usingsbt-typelevel, it doesn't appear to be customized downstream (gpg*settings aren't configured anywhere).We could probably transition from
sbt-gpgwithsbt-pgpwithout major user-facing API changes. One difference is thatsbt-pgpintroduces a newpublishSignedtask, whilesbt-gpgrewritespublish. I'm exploring the differences in a branch here.zainab-ali commentedon Aug 12, 2026
I'm exploring moving to
sbt-projectmatrixin #918. With that said,sbt-crossprojecthas just been released with SBT 2 support. We should hopefully be able to treat it as a separate upgrade.zainab-ali commentedon Aug 26, 2026
I've managed to get sbt typelevel to build with itself on SBT 2, as well as some basic typelevel projects. The code lives in a cross-build-all-plugins branch. It requires a local snapshot of SBT for sbt/sbt#9674, as well as a local snapshot of Laika for typelevel/Laika#774.
zainab-ali commentedon Sep 9, 2026
I've a local snapshot working on discipline and scalacheck. This uses a snapshot version of Laika, but everything else is on released versions. If anyone else wants to try it out, I've an evolving migration guide.
mzuehlke commentedon Sep 14, 2026
To ease the migration from crossbuild to project matrix there is a plugin to support that: https://github.com/sbt/sbt-matrix-sources