Maven Pgpsig

Maven Pgpsig is a plugin for the Maven build system that helps sign and verify PGP signatures of Maven artifacts.

Features

Maven Pgpsig provides the following features:

• Sign a Maven artifact with PGP signature
• Verify the PGP signature of a Maven artifact
• Generate a key pair for signing purposes
• Export and import a public key to/from a key server

Usage

Signing an Artifact

To sign an artifact with PGP, you need to execute the pgpsig:sign goal of the plugin. For example:

mvn pgpsig:sign

This will sign all artifacts of the current project with the default key in your keyring. You can also specify a different key by specifying the pgp.keyname property:

mvn pgpsig:sign -Dpgp.keyname=mykey

Verifying a Signature

To verify the PGP signature of an artifact, you need to execute the pgpsig:verify goal of the plugin. For example:

mvn pgpsig:verify

This will verify all artifacts of the current project against the PGP signature files in the same directory. You can also specify a different directory by specifying the pgp.dir property:

mvn pgpsig:verify -Dpgp.dir=/path/to/signatures

Generating a Key Pair

To generate a key pair for signing purposes, you need to execute the pgpsig:generate goal of the plugin. For example:

mvn pgpsig:generate

This will generate a new key pair in your keyring. You can also specify the key parameters by specifying the following properties:

• pgp.name: The name for the key
• pgp.email: The email address associated with the key
• pgp.passphrase: The passphrase for the key (optional)

Exporting and Importing a Public Key

To export a public key to a key server, you need to execute the pgpsig:keyserver-export goal of the plugin. For example:

mvn pgpsig:keyserver-export -Dpgp.keyname=mykey -Dpgp.keyserver=hkp://pgp.mit.edu

This will export the public key of the mykey key to the key server. You can also import a public key from a key server by executing the pgpsig:keyserver-import goal of the plugin. For example:

mvn pgpsig:keyserver-import -Dpgp.keyserver=hkp://pgp.mit.edu -Dpgp.keyid=12345678

This will import the public key with the key ID of 12345678 from the key server.

Conclusion

Maven Pgpsig is a powerful tool for managing PGP signatures of Maven artifacts. With its simple but effective features, you can sign, verify, generate, and export/import keys with ease. Start using Maven Pgpsig today and secure your Maven artifacts!