CODEWITHSUNDEEP
mavenpgp
pvorb
pvorb

Reputation: 7279

How to publish artifacts to Maven Central from a CI build server?

I want to publish an artifact to Maven Central from our build server, just like is common practice with internal projects in my company, which are deployed to a local Nexus.

The only difference is that artifacts on Maven Central need to be PGP-signed, before they are accepted.

How do other projects handle this? Do I need to upload my private PGP key and passphrase to the CI server? This doesn't feel right, since a private key usually should never leave my own machine. Should I build releases for Maven Central from my local machine? How does this work in teams where multiple people can publish an artifact?

While there's an official guide on how to upload artifacts and a guide on working with PGP signatures, my questions are not covered there.

Upvotes: 1

Views: 116

Answers (1)

pvorb
pvorb

Reputation: 7279

As suggested by @khmarbaise, release artifacts should be signed by individuals. This should not be done by a CI/CD server.

Upvotes: 0

Related Questions