And now with latest nightly (tested with https://services.gradle.org/distributions-snapshots/gradle-4.8-20180421000019+0000-bin.zip) it is finally just
signing {
sign publishing.publications
}
or with proper required check
signing {
required {
// signing is required if this is a release version and the artifacts are to be published
!version.toString().endsWith('-SNAPSHOT') && tasks.withType(PublishToMavenRepository).find {
gradle.taskGraph.hasTask it
}
}
sign publishing.publications
}