Publish PGP key used to sign Central artifacts 5F6CFC79F85E869F663778A4C295F5C90E4B8C58

[pzygielo]

I've consulted

• hkps://pgp.surfnet.nl
• hkps://keyserver.ubuntu.com
• hkps://keys.openpgp.org
• hkps://pgpkeys.eu

and only openpgp one has some material, but:

gpg: key C295F5C90E4B8C58: new key but contains no user ID - skipped

Result: Can't check signature: No public key for org/jboss/arquillian/testenricher/arquillian-testenricher-initialcontext/1.10.1.Final/arquillian-testenricher-initialcontext-1.10.1.Final.jar.asc

Could you share the key here or publish it somewhere, please?

[rhusar]

https://www.wildfly.org/contributors/pgp/#rhusar

https://keys.openpgp.org/vks/v1/by-fingerprint/5F6CFC79F85E869F663778A4C295F5C90E4B8C58

[jamezp]

It seems to return for me too:

gpg --keyserver hkps://keys.openpgp.org --search-keys C295F5C90E4B8C58

[rhusar]

Just fetch the key like this:

gpg --keyserver keys.openpgp.org --recv-keys 5F6CFC79F85E869F663778A4C295F5C90E4B8C58

[rhusar]

But you raise a good point – we need to publish which server to use to fetch the keys.

[pzygielo]

curl https://keys.openpgp.org/vks/v1/by-fingerprint/5F6CFC79F85E869F663778A4C295F5C90E4B8C58 | gpg --import
DL% UL%  Dled  Uled  Xfers  Live Total     Current  Left    Speed
100 --   2349     0     1     0  --:--:-- --:--:-- --:--:-- 25258      
gpg: key C295F5C90E4B8C58: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

Note: the key is skipped (not imported) as it has no user ID.

https://keys.openpgp.org/vks/v1/by-fingerprint/5F6CFC79F85E869F663778A4C295F5C90E4B8C58

That's what I meant by: only openpgp one has some material.

Thanks for checking.

[pzygielo]

Just fetch the key like this:

Please try for yourself:

mkdir /tmp/issue831 
gpg --homedir /tmp/issue831 --keyserver keys.openpgp.org --recv-keys 5F6CFC79F85E869F663778A4C295F5C90E4B8C58
gpg --homedir /tmp/issue831 --list-public-keys

With homedir with keyring with key WITH User ID - this might work.

[pzygielo]

https://keys.openpgp.org/about/:

While anyone can upload all parts of any OpenPGP key to keys.openpgp.org , our keyserver will only retain and publish certain parts under certain conditions:
...

[rhusar]

@pzygielo Oh I see the problem now. This error is reportedly a common headache when using keys.openpgp.org. Because that server prioritizes privacy, it strips the "User ID" (the name and email) from a key and GnuPG, by default, refuses to import a key that doesn't have a User ID...

[pzygielo]

But you raise a good point – we need to publish which server to use to fetch the keys.

This is already kind of handled by https://central.sonatype.org/publish/requirements/gpg/#distributing-your-public-key.

[rhusar]

@pzygielo I have fixed this problem now, thank you for pointing this out! This now works conveniently without having to manually import for pgp.

gpg --keyserver keys.openpgp.org --recv-keys C295F5C90E4B8C58

[rhusar]

But you raise a good point – we need to publish which server to use to fetch the keys.

This is already kind of handled by https://central.sonatype.org/publish/requirements/gpg/#distributing-your-public-key.

Somewhat – you know the key was published to meet that requirement but you need to find where.