Verify PGP signatures plugin

Disable the use of a checksum to check whether the collection of artifacts was validated in a previous run. If enabled and the checksum matches, skip subsequent steps that perform actual downloading of signatures and validation of artifacts against their respective signatures.

Checksums save significant time when repeatedly checking large artifact collections.

Deprecated.
Deprecated as of 1.13.0: this requirement can be expressed through the keysMap.

Fail the build if any dependency doesn't have a signature.

Fail the build if any dependency has a weak signature.

When key does not exist on key servers such information will be stored in cache.

Next checking for key existence will be done after specific hours remain.

Specifies the location of a file that contains the map of dependencies to PGP key.

This can be path to local file, path to file on plugin classpath or url address.

Format description.

Since version 1.12.0 - Multiple KeysMap configuration

You can use ready keys map: https://github.com/s4u/pgp-keys-map

PGP public key servers address.

From version 1.7.0 you can provide many key servers separated by comma, semicolon or whitespace.

From version 1.15.0 hkp/http protocols are deprecated - please use hkps/https for key servers.

If many key servers are provided, use all of them.

If set to false only first key server will be used, another as fallback.

The directory for storing cached PGP public keys.

Choose which proxy to use (id from settings.xml in maven config). Uses no proxy if the proxy was not found. If it is not set, it will take the first active proxy if any or no proxy, if no active proxy was found.

Only log errors.

Path to report file of verification result.

Report file format

Indicate if verification report should be generated.

Report file format

Scope used to build dependency list.

This scope indicates up to which scope artifacts will be included. For example, the 'test' scope will include provided, compile, runtime, and system scoped dependencies.

Skip verification altogether.

Deprecated.
Deprecated as of 1.9.0: this requirement can be expressed through the keysMap.

Does nothing - to be removed.

Suppress Signature OK

Verify dependency artifact in atypical locations:

• annotation processors in org.apache.maven.plugins:maven-compiler-plugin configuration.

In addition, it will detect when maven-surefire-plugin version 3 is used, as this will dynamically resolve and load additional artifacts. However, these artifacts are not validated.

Verify transitive dependencies of build plug-ins.

When enabled, configuration parameter verifyPlugins is enabled implicitly.

Verify Maven build plug-ins.

Verify pom files also.

Verify "provided" dependencies, which the JDK or a container provide at runtime.

Verify dependencies that are part of the current build (what Maven calls the "reactor").

This setting only affects multi-module builds that have inter-dependencies between modules. It has no effect on single-module projects nor on multi-module projects that do not have dependencies among the modules.

In affected builds, if this setting is true, and the current build is not applying GPG signatures, then the output artifacts of some of the modules in the build will not be signed. Consequently, other modules within the build that depend on those output artifacts will not pass the GPG signature check because they are unsigned. When this setting is false, GPG signatures are not checked on output artifacts of modules in the current build, to avoid this issue.

Verify dependencies at a SNAPSHOT version, instead of only verifying full release version dependencies.

Verify "system" dependencies, which are artifacts that have an explicit path specified in the POM, are always available, and are not looked up in a repository.