CODEWITHSUNDEEP
javamaven-2continuous-integrationmavengnupg
yegor256
yegor256

Reputation: 105133

Where to keep a GPG secret key for a Maven project in CI environment?

I'm trying to use maven-gpg-plugin:sign in order to sign project artifacts before deployment to Sonatype OSS repository. The question is where shall I keep my secret key secring.gpg:

  1. In continuous integration ~/.gnupg directory
  2. In project source code, e.g. src/test/resources/gpg/secring.gpg

And why?

Upvotes: 6

Views: 1667

Answers (1)

Victor Sorokin
Victor Sorokin

Reputation: 12006

If key is sensitive put it in ~/.gnupg directory on CI server and protect that directory with proper access modifiers. 2nd approach will allow every developer with access to project to see key.

Upvotes: 3

Related Questions