Run the GPG sign job after the SBOM sign

[Haroon-Khel]

If the SBOM jsf sign happens after the SBOM has been signed by the gpg key, the signature will be invalid. Nice catch Stewart

[github-actions]

Thank you for creating a pull request!

Please check out the information below if you have not made a pull request here before (or if you need a reminder how things work).

Code Quality and Contributing Guidelines

If you have not done so already, please familiarise yourself with our Contributing Guidelines and Code Of Conduct, even if you have contributed before.

Tests

Github actions will run a set of jobs against your PR that will lint and unit test your changes. Keep an eye out for the results from these on the latest commit you submitted. For more information, please see our testing documentation.

In order to run the advanced pipeline tests (executing a set of mock pipelines), it requires an admin to post run tests on this PR.
If you are not an admin, please ask for one's attention in #infrastructure on Slack or ping one here.
To run full set of tests, use "run tests"; a subset of tests on specific jdk version, use "run tests quick 11,21"

[Haroon-Khel]

building off this branch https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk17u/job/jdk17u-linux-x64-temurin/629/console

[sxa]

LGTM but to avoid ambiguity can we also update the name of the stage at line 1066:
context.stage('SBOM JSF Sign') {

[Haroon-Khel]

Im able to verify the SBOM from the above build

hkhel@hkhel-mac ~ % gpg --verify OpenJDK17U-sbom_x64_linux_hotspot_2025-01-06-14-26.json.sig OpenJDK17U-sbom_x64_linux_hotspot_2025-01-06-14-26.json
gpg: Signature made Mon  6 Jan 15:18:47 2025 GMT
gpg:                using RSA key 3B04D753C9050D9A5D343F39843C48A565F8F04B
gpg: Good signature from "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3B04 D753 C905 0D9A 5D34  3F39 843C 48A5 65F8 F04B