Maven Deploy validation failed: Invalid signature for file

post by brenoepics on Feb 6, 2024

I tried to validate in other places and it works, because I didn’t change anything other than updating to 0.3.0 of the central-publishing-maven-plugin (previous versions receive a 500 error from sonatype)

My pom.xml is here → at4j - Pastebin.com

post by cantaylancapraz on Feb 8, 2024

Did you solve this?

post by brenoepics on Feb 8, 2024

Yeah, I had to add

plugin...
<executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <phase>package</phase> <---this
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
</executions>

To all of them

post by saitejanaiduthota on Mar 24, 2024

Hi Breno,

i tried doing the same and i am still facing the same issue since 5 days . can you kindly help me on this.

this is my pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>io.github.bughunter98</groupId>
    <artifactId>blog-integrations</artifactId>
    <version>1.0.0</version>
    <name>blog-integrations</name>
    <description>This is a light-weight jar used where all the pojos required for my project are stored</description>
    <url>https://github.com/bughunter98/blogapp-integrations</url>
    <licenses>
        <license>
            <name>Apache License 2.0</name>
            <url>https://github.com/bughunter98/blogapp-integrations/blob/release-1.0.0/LICENSE</url>
        </license>
    </licenses>
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
        <java.version>17</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <central-publishing-maven-plugin.version>0.3.0</central-publishing-maven-plugin.version>
        <nexus-staging-maven-plugin.version>1.6.7</nexus-staging-maven-plugin.version>
        <maven-javadoc-plugin.version>3.6.3</maven-javadoc-plugin.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <!-- other dependencies -->
    </dependencies>
</project>

post by ogkuzmin on Mar 24, 2024

In my case the problem was that I didn’t upload the gpg public key to server. Check docs here

The command itself:

gpg --keyserver keyserver.ubuntu.com --send-keys {INSERT_YOUR_PUBLIC_KEY_HERE}

But wait a bit, Sonatype has some cache for keys

post by leo.vu on Apr 3, 2024

Hi Oleg Kuzmin,

I also have the same problem and wanted to ask

How much time does it take for Sonatype’s server cache to confirm the GPG key?

post by tyteishi on May 8, 2024

Do you have answer on this question?

post by tyteishi on May 8, 2024

I got successful publishing after 24 hours after uploading my public key to the server. I think, this moment should be reflected in documentation here. Working with PGP Signatures - The Central Repository Documentation

post by iRYO400 on May 21, 2024

Maybe it’s thanks to you a special paragraph has appeared here Distributing Your Public Key and not only that, it also lists supported GPG Keyservers:

As SKS Keyserver Network is being deprecated we recommend the use a specific GPG keyserver. Current GPG Keyservers supported by Central Servers are:

• keyserver.ubuntu.com
• keys.openpgp.org
• pgp.mit.edu

post by add2ws on Sep 20, 2024

In my case, just delete the rest GPG keys on my computer, then it’s worked. I hope it is helpful

post by visal on Jan 13, 2025

I have that problem too but I use build.gradle to publish any solution for me ?

here is my config :

plugins {
    id 'com.android.library'
    id 'maven-publish'
    id 'signing'
    id "com.vanniktech.maven.publish"  version "0.28.0"
}
//other config
mavenPublishing {
    coordinates("io.bill24", "b24paymentsdk", "1.0.1")
    pom {
        name = "B24 Payment SDK"
        description = "A library provided by B24 Company that enables online payments and digital wallet functionality."
        inceptionYear = "2026"
        url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
        licenses {
            license {
                name = "The Apache License, Version 2.0"
                url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
                distribution = "repo"
            }
        }
        developers {
            developer {
                id = "Bill24CoLtd"
                name = "Bill24CoLtd"
                url = "https://github.com/Bill24CoLtd/"
            }
        }
        scm {
            url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
            connection = "scm:git:git://github.com/Bill24CoLtd/Android-B24PaymentSdk.git"
            developerConnection = "scm:git:ssh://git@github.com:Bill24CoLtd/Android-B24PaymentSdk.git"
        }
    }
    publishToMavenCentral("CENTRAL_PORTAL", true)
    signAllPublications()
}

post by Shadman_Adman on Feb 24, 2025

Hello. I had the same error.In my case The problem was in the signing section. I fix it by applying the signing manually:

add the plugin in your gradle:

id("signing")

then config it:

signing {
    useInMemoryPgpKeys(
        keystoreProperties["signing.keyId"].toString(),
        File(keystoreProperties["signing.secretKeyFile"].toString()).readText(),
        keystoreProperties["signing.password"].toString()
    )
}

hope it helps someone. Happy coding