// Copyright (C) 2024 Gradle, Inc.
//
// Licensed under the Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License.;
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      https://creativecommons.org/licenses/by-nc-sa/4.0/
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

[[publishing_maven:signing]]
= Signing artifacts

The <<signing_plugin.adoc#signing_plugin, Signing Plugin>> can be used to sign all artifacts and metadata files that make up a publication, including Maven POM files and Ivy module descriptors. In order to use it:

1. Apply the Signing Plugin
2. Configure the <<signing_plugin.adoc#sec:signatory_credentials,signatory credentials>> — follow the link to see how
3. Specify the publications you want signed

Here's an example that configures the plugin to sign the `mavenJava` publication:

====
include::sample[dir="snippets/reference/dependency-management/publishing/maven-publish/kotlin",files="build.gradle.kts[tags=sign-publication]"]
include::sample[dir="snippets/reference/dependency-management/publishing/maven-publish/groovy",files="build.gradle[tags=sign-publication]"]
====

This will create a `Sign` task for each publication you specify and wire all `publish__PubName__PublicationTo__RepoName__Repository` tasks to depend on it. Thus, publishing any publication will automatically create and publish the signatures for its artifacts and metadata, as you can see from this output:

== Example: Sign and publish a project

[source,bash]
----
$ ./gradlew publish
----
[source,text]
----
include::{snippetsPath}/reference/dependency-management/publishing/maven-publish/tests/publishingMavenSignAndPublish.out[]
----
