Allow DerivedArtifact to expose a getExtension()

[loosebazooka]

Expected Behavior

A signer alternative to pgp (like sigstore in this case) which uses an extension .sigstore.json should be able to publish with that extension when doing a maven publish (this is not supported without a bit of a hack).

The PublicationInternal object could add the extension to the interface

    interface DerivedArtifact {
        boolean shouldBePublished();
        File create();
+       String getExtension();
    }

I also understand that we kinda need to access some of these internal APIs to make this happen from a 3rd party plugin.

Current Behavior (optional)

The extension is computed from the filename which means it's the last of X.Y.Z which in this case is .Z instead of .Y.Z. See code:

gradle/platforms/software/maven/src/main/java/org/gradle/api/publish/maven/internal/artifact/DerivedMavenArtifact.java

Line 44 in ec838d8

return original.getExtension() + "." + getFileExtension(getFile().getName());

So during publication of my.jar.sigstore.json, the maven publication generates a finished dervied object as my.jar.json (instead of my.jar.sigstore.json)

Context

Sigstore signatures are expected to use the final extension .sigstore.json. There is a workaround that can be done by explicitly setting the extension on the PublicationArtifact (which we do infact exploit), but the current interface for DerviedArtifact could make this less hacky.

[ov7a]

This issue needs a decision from the team responsible for that area. They have been informed. Response time may vary.

---

Relates to:

• Provide API for adding artifact signatures #26760

[big-guy]

@loosebazooka do you have a workaround for now or would this unblock you?

[loosebazooka]

Yeah workaround exists. Plus I would have to be pretty backward compatible for now. This is just a request for a change in the future.