Crossbuild to sbt 2.x

[LukaJCB]

Blocked by plugin dependencies:

• https://github.com/BotTech/sbt-gpg
• sbt 2 portable-scala/sbt-crossproject#178
• https://github.com/typelevel/Laika

[SethTisue]

fyi @anatoliykmetyuk... wanted to make sure this is on your radar, as getting this upgrade through would unlock the possibility for a large number of OSS projects under the Typelevel umbrella to move to sbt 2

@eed3si9n and @tanishiking are aware but I'll @ them anyway :-)

[SethTisue]

sbt-gpg has been unmaintained for 8 years and I'm a bit surprised that sbt-typelevel even uses it. have alternatives been considered? sbt-ci-release uses sbt-pgp. (before you ask, I don't know what the difference is...)

oh, I see that at one point @jodersky revived it at https://github.com/jodersky/sbt-gpg , and I think that's the one you're depending on? but that one has no commits in 5 years

[eed3si9n]

(before you ask, I don't know what the difference is...)

The original flavor sbt-pgp, written by Josh circa Typesafe days, generally had the philosophy that JVM should stand on its own (partly to accommodate macOS vs Windows) so it adopted Java-based Bouncy Castle library as its main engine, with the alternative to use CLI GnuPG (gpg).

In the ensuing years, cloud-based CI became common, and Bouncy Castle lagged behind the command-line GnuPG. sbt-gpg was created as a lightweight alternative that delegates all operations to command-line GnuPG. This meant that it would require gpg installed on the machine, but for projects that automate publishing from the CI, or Daniel Spiewak with YubiKeys, relying on gpg made more sense.

At some point, I took over the development of sbt-pgp and released sbt-pgp 2.0.0 (https://github.com/sbt/sbt-pgp/releases/tag/v2.0.0), which flipped useGpg to true and incorporated other ideas from sbt-gpg, like using credentials to specify the signing key with Daniel's blessing. The intent here was to migrate the existing sbt-pgp users to the GnuPG CLI world. So for sbt-pgp 2.x, there shouldn't be much difference between sbt-gpg.