Maven distribution signing key not found on keys.openpgp.org
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
Research direction
Start by reproducing the failure in a Maven project with java-jwt 4.6.0, jwks-rsa 0.24.1, pgpverify-maven-plugin 1.19.1, and Maven 3.9.16, then run mvn verify. Check how the 0xD8E6762C6CB29F64 signing key is published for these distributions; done means the key is available on keys.openpgp.org and signature verification succeeds.
Written by the indexing model from the issue text.
Description
Checklist
- I have looked into the Readme and Examples, and have not found a suitable solution or answer.
- I have looked into the API documentation and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
The PGP key 0xD8E6762C6CB29F64 used for signing maven distribution of java-jwt 4.6.0 (https://repo.maven.apache.org/maven2/com/auth0/java-jwt/4.6.0/java-jwt-4.6.0.jar) and jwks-rsa 0.24.1, is not available on https://keys.openpgp.org, causing signature verification, using org.simplify4u.plugins.pgpverify-maven-plugin, to fail. This is the same key as in the past, used for java-jwt 4.5.2 and older releases.
Reproduction
Create a maven project that uses java-jwt and jwks-rsa as dependency.
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>4.6.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>jwks-rsa</artifactId>
<version>0.24.1</version>
</dependency>
Set up signature verification
<plugin>
<groupId>org.simplify4u.plugins</groupId>
<artifactId>pgpverify-maven-plugin</artifactId>
<version>1.19.1</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
Run mvn verify
Verification fails
[ERROR] com.auth0:java-jwt:pom:4.6.0 PGP key 0xD8E6762C6CB29F64 not found on keyserver
Additional context
Using maven version 3.9.16
java-jwt version
4.6.0
Java version
21.0.12
- Dominant language
- Java
- Stars
- 6.2k
- Forks
- 945
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/java-jwt
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 72/100
-
feature request
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
feature request
Difficulty 3/5 1-2 days Newbie friendliness 45/100
-
feature request
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
opensearch-project/k-NN#3597 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100