# Maven Deploy validation failed: Invalid signature for file

## post by brenoepics on Feb 6, 2024

I tried to validate in other places and it works, because I didn’t change anything other than updating to 0.3.0 of the central-publishing-maven-plugin (previous versions receive a 500 error from sonatype)

My pom.xml is here → [at4j - Pastebin.com](https://pastebin.com/ceuW22rh)

## post by cantaylancapraz on Feb 8, 2024

Did you solve this?

## post by brenoepics on Feb 8, 2024

Yeah, I had to add

```java
plugin...
<executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <phase>package</phase> <---this
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
</executions>
```

To all of them

## post by saitejanaiduthota on Mar 24, 2024

Hi Breno,

i tried doing the same and i am still facing the same issue since 5 days . can you kindly help me on this.

this is my pom.xml

```xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>io.github.bughunter98</groupId>
    <artifactId>blog-integrations</artifactId>
    <version>1.0.0</version>
    <name>blog-integrations</name>
    <description>This is a light-weight jar used where all the pojos required for my project are stored</description>
    <url>https://github.com/bughunter98/blogapp-integrations</url>
    <licenses>
        <license>
            <name>Apache License 2.0</name>
            <url>https://github.com/bughunter98/blogapp-integrations/blob/release-1.0.0/LICENSE</url>
        </license>
    </licenses>
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
        <java.version>17</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <central-publishing-maven-plugin.version>0.3.0</central-publishing-maven-plugin.version>
        <nexus-staging-maven-plugin.version>1.6.7</nexus-staging-maven-plugin.version>
        <maven-javadoc-plugin.version>3.6.3</maven-javadoc-plugin.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <!-- other dependencies -->
    </dependencies>
</project>
```

## post by ogkuzmin on Mar 24, 2024

In my case the problem was that I didn’t upload the gpg public key to server. Check docs [here](https://central.sonatype.org/publish/requirements/gpg/#dealing-with-expired-keys)

The command itself:

```css
gpg --keyserver keyserver.ubuntu.com --send-keys {INSERT_YOUR_PUBLIC_KEY_HERE}
```

But wait a bit, Sonatype has some cache for keys

## post by leo.vu on Apr 3, 2024

Hi Oleg Kuzmin,

I also have the same problem and wanted to ask

How much time does it take for Sonatype’s server cache to confirm the GPG key?

## post by tyteishi on May 8, 2024

Do you have answer on this question?

## post by tyteishi on May 8, 2024

I got successful publishing after 24 hours after uploading my public key to the server. I think, this moment should be reflected in documentation here. [Working with PGP Signatures - The Central Repository Documentation](https://central.sonatype.org/publish/requirements/gpg/#installing-gnupg)

## post by iRYO400 on May 21, 2024

Maybe it’s thanks to you a special paragraph has appeared here [Distributing Your Public Key](https://central.sonatype.org/publish/requirements/gpg/#distributing-your-public-key) and not only that, it also lists supported GPG Keyservers:

> As SKS Keyserver Network is being deprecated we recommend the use a specific GPG keyserver. Current GPG Keyservers supported by Central Servers are:
>
> - `keyserver.ubuntu.com`
> - `keys.openpgp.org`
> - `pgp.mit.edu`

## post by add2ws on Sep 20, 2024

In my case, just delete the rest GPG keys on my computer, then it’s worked. I hope it is helpful

## post by visal on Jan 13, 2025

I have that problem too but I use build.gradle to publish
any solution for me ?

here is my config :

```auto
plugins {
    id 'com.android.library'
    id 'maven-publish'
    id 'signing'
    id "com.vanniktech.maven.publish"  version "0.28.0"
}
//other config
mavenPublishing {
    coordinates("io.bill24", "b24paymentsdk", "1.0.1")
    pom {
        name = "B24 Payment SDK"
        description = "A library provided by B24 Company that enables online payments and digital wallet functionality."
        inceptionYear = "2026"
        url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
        licenses {
            license {
                name = "The Apache License, Version 2.0"
                url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
                distribution = "repo"
            }
        }
        developers {
            developer {
                id = "Bill24CoLtd"
                name = "Bill24CoLtd"
                url = "https://github.com/Bill24CoLtd/"
            }
        }
        scm {
            url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
            connection = "scm:git:git://github.com/Bill24CoLtd/Android-B24PaymentSdk.git"
            developerConnection = "scm:git:ssh://git@github.com:Bill24CoLtd/Android-B24PaymentSdk.git"
        }
    }
    publishToMavenCentral("CENTRAL_PORTAL", true)
    signAllPublications()
}
```

## post by Shadman_Adman on Feb 24, 2025

Hello. I had the same error.In my case The problem was in the signing section. I fix it by applying the signing manually:

add the plugin in your gradle:

`    id("signing")`

then config it:

```scss
signing {
    useInMemoryPgpKeys(
        keystoreProperties["signing.keyId"].toString(),
        File(keystoreProperties["signing.secretKeyFile"].toString()).readText(),
        keystoreProperties["signing.password"].toString()
    )
}
```

hope it helps someone. Happy coding