From: "Peter Palaga" <ppalaga(a)redhat.com&gt; To: hawkular-dev(a)lists.jboss.org Sent: Monday, March 30, 2015 8:58:58 AM Subject: [Hawkular-dev] Proposal: Add PGP artifact signing Hi *, I propose to add maven-gpg-plugin to the release profile, similarly as I did for javadoc and sources in https://github.com/hawkular/hawkular-parent-pom/commit/d54a8d03b4ef251d59... A pom.xml snippet is in https://issues.jboss.org/browse/HAWKULAR-108 == Why? Because Maven Central requires it [1]. Although apparently, they already have accepted our unsigned artifacts already. I would not let our CI to sign the SNAPSHOT releases. == So what is the problem? The team members doing releases would have to * install native OS-level gpg software * generate a key pair * publish their public key See [2] Is the above acceptable? Thanks, Peter [1] http://maven.apache.org/guides/mini/guide-central-repository-upload.html#... [2] http://blog.sonatype.com/2010/01/how-to-generate-pgp-signatures-with-maven _______________________________________________ hawkular-dev mailing list hawkular-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/hawkular-dev