search

JetBrains / java-annotations

Annotations for JVM-based languages.
Apache License 2.0
404 stars 47 forks source link

Please publish the official PGP keys so the releases can be verified #63

Closed vlsi closed 2 years ago

vlsi commented 2 years ago

See https://youtrack.jetbrains.com/issue/KT-33781 See https://github.com/junit-team/junit5/issues/2020

I get the following error when upgrading to 23.0:

Checksum/PGP violations detected on resolving configuration :src:core:compileClasspath
Trusted PGP keys for group org.jetbrains are [bcf4173966770193, 379ce192d401ab61],
however artifact is signed by [c2148900bcd3c2af] only:
org.jetbrains:annotations:23.0.0 (pgp=[c2148900bcd3c2af], sha512=[computation skipped])

Note: this is different from https://github.com/JetBrains/java-annotations/issues/62, and what I want is a reference of the official PGP key(s) on the project website (or at GitHub).

amaembo commented 2 years ago

Committed to the repo root. Btw it's also available here: https://download.jetbrains.com/KEYS

vlsi commented 2 years ago

Nice, thank you. It would be great to have a link as well near Using the annotations section or a PGP badge.

amaembo commented 2 years ago

It would be great to have a link as well near Using the annotations section or a PGP badge.

PR is welcome :-)

ao-apps commented 2 years ago

Thank you for adding the key. We have added this information to the PGP Keys Map project supported by @s4u. They provide a Maven plugin that verifies PGP keys during builds.

https://github.com/s4u/pgp-keys-map/pull/688