Maven Deploy validation failed: Invalid signature for file

post by brenoepics on Feb 6, 2024

I tried to validate in other places and it works, because I didn’t change anything other than updating to 0.3.0 of the central-publishing-maven-plugin (previous versions receive a 500 error from sonatype)

My pom.xml is here → at4j - Pastebin.com

post by cantaylancapraz on Feb 8, 2024

Did you solve this?

post by brenoepics on Feb 8, 2024

Yeah, I had to add

plugin...
<executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <phase>package</phase> <---this
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
</executions>

post by saitejanaiduthota on Mar 24, 2024

Hi Breno,

i tried doing the same and i am still facing the same issue since 5 days. can you kindly help me on this.

this is my pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" ...>
    <!-- Full pom.xml content here -->
</project>

post by ogkuzmin on Mar 24, 2024

In my case the problem was that I didn’t upload the gpg public key to server. Check docs here

The command itself:

gpg --keyserver keyserver.ubuntu.com --send-keys {INSERT_YOUR_PUBLIC_KEY_HERE}

post by leo.vu on Apr 3, 2024

Hi Oleg Kuzmin,

I also have the same problem and wanted to ask

How much time does it take for Sonatype’s server cache to confirm the GPG key?

post by tyteishi on May 8, 2024

Do you have answer on this question?

post by tyteishi on May 8, 2024

I got successful publishing after 24 hours after uploading my public key to the server. I think, this moment should be reflected in documentation here. Working with PGP Signatures - The Central Repository Documentation

post by iRYO400 on May 21, 2024

Maybe it’s thanks to you a special paragraph has appeared here Distributing Your Public Key and not only that, it also lists supported GPG Keyservers:

As SKS Keyserver Network is being deprecated we recommend the use an specific GPG keyserver. Current GPG Keyservers supported by Central Servers are:

• keyserver.ubuntu.com
• keys.openpgp.org
• pgp.mit.edu

post by add2ws on Sep 20, 2024

In my case, just delete the rest GPG keys on my computer, then it’s worked. I hope it is helpful.

post by visal on Jan 13, 2025

I have that problem too but I use build.gradle to publish. any solution for me ?

here is my config :

plugins {
    id 'com.android.library'
    id 'maven-publish'
    id 'signing'
    id "com.vanniktech.maven.publish"  version "0.28.0"
}
...

post by Shadman_Adman on Feb 24, 2025

Hello. I had the same error. In my case, the problem was in the signing section. I fix it by applying the signing manually:

add the plugin in your gradle:

id("signing")

then config it:

signing {
    useInMemoryPgpKeys(
        keystoreProperties["signing.keyId"].toString(),
        File(keystoreProperties["signing.secretKeyFile"].toString()).readText(),
        keystoreProperties["signing.password"].toString()
    )
}