Maven distribution signing key not found on keys.openpgp.org

Open
#791 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
release, security

Research direction

Start by reproducing the failure in a Maven project with java-jwt 4.6.0, jwks-rsa 0.24.1, pgpverify-maven-plugin 1.19.1, and Maven 3.9.16, then run mvn verify. Check how the 0xD8E6762C6CB29F64 signing key is published for these distributions; done means the key is available on keys.openpgp.org and signature verification succeeds.

Written by the indexing model from the issue text.

Description

bug
Checklist
  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.
Description

The PGP key 0xD8E6762C6CB29F64 used for signing maven distribution of java-jwt 4.6.0 (https://repo.maven.apache.org/maven2/com/auth0/java-jwt/4.6.0/java-jwt-4.6.0.jar) and jwks-rsa 0.24.1, is not available on https://keys.openpgp.org, causing signature verification, using org.simplify4u.plugins.pgpverify-maven-plugin, to fail. This is the same key as in the past, used for java-jwt 4.5.2 and older releases.

Reproduction

Create a maven project that uses java-jwt and jwks-rsa as dependency.

    <dependency>
      <groupId>com.auth0</groupId>
      <artifactId>java-jwt</artifactId>
      <version>4.6.0</version>
    </dependency>
    <dependency>
      <groupId>com.auth0</groupId>
      <artifactId>jwks-rsa</artifactId>
      <version>0.24.1</version>
    </dependency>

Set up signature verification

      <plugin>
        <groupId>org.simplify4u.plugins</groupId>
        <artifactId>pgpverify-maven-plugin</artifactId>
        <version>1.19.1</version>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

Run mvn verify

Verification fails

[ERROR] com.auth0:java-jwt:pom:4.6.0 PGP key 0xD8E6762C6CB29F64 not found on keyserver

Additional context

Using maven version 3.9.16

java-jwt version

4.6.0

Java version

21.0.12

Dominant language
Java
Stars
6.2k
Forks
945
Avg merge
2d 15h
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from auth0/java-jwt

All issues in auth0/java-jwt

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.