# Maven Deploy validation failed: Invalid signature for file

## post by brenoepics on Feb 6, 2024
 
I tried to validate in other places and it works, because I didn’t change anything other than updating to 0.3.0 of the central-publishing-maven-plugin (previous versions receive a 500 error from sonatype)

My pom.xml is here → [at4j - Pastebin.com](https://pastebin.com/ceuW22rh)

## post by cantaylancapraz on Feb 8, 2024

Did you solve this?

## post by brenoepics on Feb 8, 2024

Yeah, I had to add

```java
plugin...
<executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <phase>package</phase> <---this
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
</executions>
```

## post by saitejanaiduthota on Mar 24, 2024

Hi Breno,

i tried doing the same and i am still facing the same issue since 5 days. can you kindly help me on this.

this is my pom.xml

```xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" ...>
    <!-- Full pom.xml content here -->
</project>
```

## post by ogkuzmin on Mar 24, 2024

In my case the problem was that I didn’t upload the gpg public key to server. Check docs [here](https://central.sonatype.org/publish/requirements/gpg/#dealing-with-expired-keys)

The command itself:

```css
gpg --keyserver keyserver.ubuntu.com --send-keys {INSERT_YOUR_PUBLIC_KEY_HERE}
```

## post by leo.vu on Apr 3, 2024

Hi Oleg Kuzmin,

I also have the same problem and wanted to ask

How much time does it take for Sonatype’s server cache to confirm the GPG key?

## post by tyteishi on May 8, 2024

Do you have answer on this question?

## post by tyteishi on May 8, 2024

I got successful publishing after 24 hours after uploading my public key to the server. I think, this moment should be reflected in documentation here. [Working with PGP Signatures - The Central Repository Documentation](https://central.sonatype.org/publish/requirements/gpg/#installing-gnupg)

## post by iRYO400 on May 21, 2024

Maybe it’s thanks to you a special paragraph has appeared here [Distributing Your Public Key](https://central.sonatype.org/publish/requirements/gpg/#distributing-your-public-key) and not only that, it also lists supported GPG Keyservers:

> As SKS Keyserver Network is being deprecated we recommend the use an specific GPG keyserver. Current GPG Keyservers supported by Central Servers are:
> 
> - `keyserver.ubuntu.com`
> - `keys.openpgp.org`
> - `pgp.mit.edu`

## post by add2ws on Sep 20, 2024

In my case, just delete the rest GPG keys on my computer, then it’s worked. I hope it is helpful.

## post by visal on Jan 13, 2025

I have that problem too but I use build.gradle to publish. any solution for me ?

here is my config :

```groovy
plugins {
    id 'com.android.library'
    id 'maven-publish'
    id 'signing'
    id "com.vanniktech.maven.publish"  version "0.28.0"
}
...
```

## post by Shadman_Adman on Feb 24, 2025

Hello. I had the same error. In my case, the problem was in the signing section. I fix it by applying the signing manually:

add the plugin in your gradle:

`
    id("signing")
`

then config it:

```groovy
signing {
    useInMemoryPgpKeys(
        keystoreProperties["signing.keyId"].toString(),
        File(keystoreProperties["signing.secretKeyFile"].toString()).readText(),
        keystoreProperties["signing.password"].toString()
    )
}
```