`publishLocal` attempts to sign artifacts

[armanbilge]

Reported by @milessabin:

One minor annoyance is that publishLocal seems to insist on signing. As in it prompts me for my key passphrase at least once per SBT reload.

AFAIK publishLocal doesn't require signing to succeed, but it will attempt to sign if a PGP key is configured, hence the annoyance with the passphrase in this instance.

Ideally, publishLocal shouldn't try to sign anything at all.

[armanbilge]

Seems this is something we've inherited from sbt-gpg.

publishLocal / packagedArtifacts := {
  packagedArtifactsImpl(
    (publishLocal / packagedArtifacts).value,
    gpg.value,
    (publishLocal / gpgWarnOnFailure).value)(streams.value.log.warn(_))
}

https://github.com/jodersky/sbt-gpg/blob/efcba49fc9d8e07d84f05b5d48386f72bbb81e1a/src/main/scala/SbtGpg.scala#L80

This might not be easy to fix in sbt-typelevel.