Maven Deploy validation failed: Invalid signature for file - Central Repository - Sonatype Community
Maven Deploy validation failed: Invalid signature for file
post by brenoepics on Feb 6, 2024
I tried to validate in other places and it works, because I didn’t change anything other than updating to 0.3.0 of the central-publishing-maven-plugin (previous versions receive a 500 error from sonatype)
My pom.xml is here → at4j - Pastebin.com
post by cantaylancapraz on Feb 8, 2024
Did you solve this?
post by brenoepics on Feb 8, 2024
Yeah, I had to add
<executions>
<execution>
<id>attach-javadocs</id>
<phase>package</phase> <---this
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
post by saitejanaiduthota on Mar 24, 2024
Hi Breno,
i tried doing the same and I am still facing the same issue since 5 days. Can you kindly help me on this.
this is my pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.2.0</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>io.github.bughunter98</groupId>
<artifactId>blog-integrations</artifactId>
<version>1.0.0</version>
<name>blog-integrations</name>
<description>This is a light-weight jar used where all the pojos required for my project are stored</description>
<url>https://github.com/bughunter98/blogapp-integrations</url>
<licenses>
<license>
<name>Apache License 2.0</name>
<url>https://github.com/bughunter98/blogapp-integrations/blob/release-1.0.0/LICENSE</url>
</license>
</licenses>
<properties>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
<java.version>17</java.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<central-publishing-maven-plugin.version>0.3.0</central-publishing-maven-plugin.version>
<nexus-staging-maven-plugin.version>1.6.7</nexus-staging-maven-plugin.version>
<maven-javadoc-plugin.version>3.6.3</maven-javadoc-plugin.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.modelmapper</groupId>
<artifactId>modelmapper</artifactId>
<version>3.2.0</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<scope>runtime</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>com.mysql</groupId>
<artifactId>mysql-connector-j</artifactId>
<version>8.2.0</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-test</artifactId>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>${maven-compiler-plugin.version}</version>
<configuration>
<source>${java.version}</source>
<target>${java.version}</target>
</configuration>
</plugin>
<plugin>
<groupId>org.sonatype.central</groupId>
<artifactId>central-publishing-maven-plugin</artifactId>
<version>${central-publishing-maven-plugin.version}</version>
<extensions>true</extensions>
<configuration>
<publishingServerId>central</publishingServerId>
<tokenAuth>true</tokenAuth>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>3.3.0</version>
<executions>
<execution>
<id>attach-sources</id>
<phase>package</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.2.5</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
<version>3.3.1</version>
<executions>
<execution>
<id>copy-resources</id>
<phase>validate</phase>
<goals>
<goal>copy-resources</goal>
</goals>
<configuration>
<outputDirectory>${project.build.outputDirectory}</outputDirectory>
<resources>
<resource>
<directory>${project.basedir}/src/main/resources</directory>
<filtering>true</filtering>
</resource>
</resources>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>0.8.11</version>
<executions>
<execution>
<id>prepare-agent</id>
<goals>
<goal>prepare-agent</goal>
</goals>
</execution>
<execution>
<id>report</id>
<goals>
<goal>report</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>${maven-javadoc-plugin.version}</version>
<configuration>
<javadocExecutable>${java.home}/bin/javadoc</javadocExecutable>
</configuration>
<executions>
<execution>
<id>attach-javadocs</id>
<phase>package</phase>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>3.1.0</version>
<executions>
<execution>
<id>sign-artifacts</id>
<phase>verify</phase>
<goals>
<goal>sign</goal>
</goals>
<configuration>
<keyname>// not attaching this in the reply</keyname>
<gpgArguments>
<arg>--pinentry-mode</arg>
<arg>loopback</arg>
</gpgArguments>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.sonatype.plugins</groupId>
<artifactId>nexus-staging-maven-plugin</artifactId>
<version>${nexus-staging-maven-plugin.version}</version>
<extensions>true</extensions>
<configuration>
<serverId>ossrh</serverId>
<nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
<autoReleaseAfterClose>true</autoReleaseAfterClose>
</configuration>
</plugin>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<configuration>
<excludes>
<exclude>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</exclude>
</excludes>
<skip>true</skip>
</configuration>
</plugin>
</plugins>
</build>
<distributionManagement>
<snapshotRepository>
<id>ossrh</id>
<url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
</snapshotRepository>
<repository>
<id>ossrh</id>
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
</repository>
</distributionManagement>
<developers>
<developer>
<name>bug hunter98</name>
<email>saitejathota@gmail.com</email>
<organization>io.github.bughunter98</organization>
<organizationUrl>https://github.com/bughunter98</organizationUrl>
</developer>
</developers>
<scm>
<connection>scm:git:git://github.com/bughunter98/blogapp-integrations.git</connection>
<developerConnection>scm:git:ssh://github.com:bughunter98/blogapp-integrations.git</developerConnection>
<url>https://github.com/bughunter98/blogapp-integrations</url>
</scm>
</project>
post by ogkuzmin on Mar 24, 2024
In my case the problem was that I didn’t upload the gpg public key to server. Check docs here
The command itself:
gpg --keyserver keyserver.ubuntu.com --send-keys {INSERT_YOUR_PUBLIC_KEY_HERE}
post by leo.vu on Apr 3, 2024
Hi Oleg Kuzmin,
I also have the same problem and wanted to ask
How much time does it take for Sonatype’s server cache to confirm the GPG key?
post by tyteishi on May 8, 2024
Do you have answer on this question?
post by iRYO400 on May 21, 2024
Maybe it’s thanks to you a special paragraph has appeared here Distributing Your Public Key and not only that, it also lists supported GPG Keyservers:
As SKS Keyserver Network is being deprecated we recommend the use an specific GPG keyserver. Current GPG Keyservers supported by Central Servers are:
keyserver.ubuntu.comkeys.openpgp.orgpgp.mit.edu
post by visal on Jan 13, 2025
I have that problem too but I use build.gradle to publish
any solution for me ?
here is my config :
plugins {
id 'com.android.library'
id 'maven-publish'
id 'signing'
id "com.vanniktech.maven.publish" version "0.28.0"
}
...//other config
mavenPublishing {
coordinates("io.bill24", "b24paymentsdk", "1.0.1")
pom {
name = "B24 Payment SDK"
description = "A library provided by B24 Company that enables online payments and digital wallet functionality."
inceptionYear = "2026"
url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
licenses {
license {
name = "The Apache License, Version 2.0"
url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
distribution = "repo"
}
}
developers {
developer {
id = "Bill24CoLtd"
name = "Bill24CoLtd"
url = "https://github.com/Bill24CoLtd/"
}
}
scm {
url = "https://github.com/Bill24CoLtd/Android-B24PaymentSdk/"
connection = "scm:git:git://github.com/Bill24CoLtd/Android-B24PaymentSdk.git"
developerConnection = "scm:git:ssh://git@github.com:Bill24CoLtd/Android-B24PaymentSdk.git"
}
}
publishToMavenCentral("CENTRAL_PORTAL", true)
signAllPublications()
}
post by Shadman_Adman on Feb 24, 2025
Hello. I had the same error. In my case The problem was in the signing section. I fix it by applying the signing manually:
add the plugin in your gradle:
id("signing")
then config it:
signing {
useInMemoryPgpKeys(
keystoreProperties["signing.keyId"].toString(),
File(keystoreProperties["signing.secretKeyFile"].toString()).readText(),
keystoreProperties["signing.password"].toString()
)
}
hope it helps someone. Happy coding.