[🚀 Feature]: Publish updated key used to sign artifacts published to Central

[pzygielo]

Feature and motivation

I've sent following as e-mail previously (21 Jun 2024) but got no response:

---

Hello Titus

I'm seeing this discrepancy:

$ gpg org/seleniumhq/selenium/selenium-api/4.22.0/selenium-api-4.22.0.jar.asc
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: assuming signed data in
'org/seleniumhq/selenium/selenium-api/4.22.0/selenium-api-4.22.0.jar'
gpg: Signature made Thu 20 Jun 2024 22:24:25 CEST
gpg:                using RSA key F23E6F40ED06B8E0B269523C0DE2A6EBAF6DB53F
gpg: Good signature from "Titus Fortner <[titus@saucelabs.com](mailto:titus@saucelabs.com)>" [expired]
gpg: Note: This key has expired!

$ gpg --list-public-keys  F23E6F40ED06B8E0B269523C0DE2A6EBAF6DB53F
pub   rsa2048 2020-03-26 [SC] [expired: 2022-03-26]
      F23E6F40ED06B8E0B269523C0DE2A6EBAF6DB53F
uid           [ expired] Titus Fortner <[titus@saucelabs.com](mailto:titus@saucelabs.com)>
sub   rsa2048 2020-03-26 [E] [expired: 2022-03-26]

Key expired: 2022-03-26
Signature made: 2024-06-20

Can you share the updated [I suppose] key, please?
I've consulted keyserver.ubuntu.com and keywin.trifence.ch but
there is no newer version available there.

---

For 4.30.0 I'm getting similar results.
Checked hkps://pgp.surfnet.nl hkps://keyserver.ubuntu.com hkps://keys.openpgp.org hkps://pgpkeys.eu for key updates but got none.

Usage example

I could verify signatures w/o warnings about expired key.

[github-actions]

@pzygielo, thank you for creating this issue. We will troubleshoot it as soon as we can.

---

Info for maintainers

Triage this issue by using labels.

If information is missing, add a helpful comment and then I-issue-template label.

If the issue is a question, add the I-question label.

If the issue is valid but there is no time to troubleshoot it, consider adding the help wanted label.

If the issue requires changes or fixes from an external project (e.g., ChromeDriver, GeckoDriver, MSEdgeDriver, W3C), add the applicable G-* label, and it will provide the correct link and auto-close the issue.

After troubleshooting the issue, please add the R-awaiting answer label.

Thank you!

[pzygielo]

I see no change with the current 4.31.0 release.

[pzygielo]

4.32.0 was signed with different key, which is fine.

[diemol]

Yes, @titusfortner will regenerate his key to avoid this in the future. I did the 4.32 release and that is why you did not get the warning anymore.

[github-actions]

This issue has been automatically locked since there has not been any recent activity since it was closed. Please open a new issue for related bugs.