GPG Keys & Signing Artifacts for Sonatype

GPG Keys

Sonatype requires that artifacts be signed using a GPG key in order to publish to the central repository.

The project's pom.xml file is configured to automatically sign release artifacts using gpg.
The gpg binary must be available on the host operating system.

Generate a key

To generate a new key.

gpg --gen-key

This will ask for your real name, email address and a passphrase.
Once the key pair is generated, it will be automatically added to your local gpg keyring.

List Keys

To view public keys in your keyring

gpg --list-keys

This will print out your keys which will look something like this

pub   ed25519 2023-02-18 [SC] [expires: 2025-02-17]
      B8357E706C250B057DA416B296C854704C31BCA6
uid           [ultimate] Benjamin Possolo <bpossolo@gmail.com>
sub   cv25519 2023-02-18 [E] [expires: 2025-02-17]

In this case, the key id is B8357E706C250B057DA416B296C854704C31BCA6.
You'll need this for other commands below.

Publish Public Key to Keyserver

gpg --send-keys KEY_ID

This will send your public key to the communal keyserver hkps://keyserver.ubuntu.com.
Other people on the internet and Sonatype will then be able to verify your digitally signed release artifacts.

Expiration

Keys have a built-in expiration date.
Once they expire, Sonatype will reject the release artifacts.
In order to address this, you should delete the expired key pair, generate a new one, then publish that new key to a public gpg key server.

Deleting a key from local keyring

Delete the public/private key pair from your local keyring

gpg --delete-secret-keys KEY_ID
gpg --delete-keys KEY_ID