I've Just Liberated My Modules

Re:I've Just Liberated My Modules by lmm on Wednesday March 23, 2016 @05:50AM (#11343114)

Maven central requires GPG signatures for every package, so all major libraries on the JVM have GPG signatures.

(Whether anyone's checking them is another question, but at least you can if you want to)

[ Parent | on HN ]

Re:I've Just Liberated My Modules by mike_hearn on Wednesday March 23, 2016 @06:10AM (#11343182)

I really doubt anyone checks them. It's not integrated or enabled by default, there's no way to pin keys in the build files, etc. GPG isn't the solution to such problems, unfortunately.

In one of my old projects (bitcoinj) we did write a Maven plugin that let you put the hashes of the dependencies into your build file.

However it's rare to see Maven/Gradle builds that accept version ranges. And once downloaded it's cached.

[ Parent | on HN ]

Re:I've Just Liberated My Modules by lmm on Wednesday March 23, 2016 @06:42AM (#11343298)

There's a plugin for checking it in maven ( http://www.simplify4u.org/pgpverify-maven-plugin/plugin-info... ) that allows pinning the keys.

Ranges are rare but I'm not sure why - maven actually has very good support for them. I guess it's just that they're not the default?

[ Parent | on HN ]

Re:I've Just Liberated My Modules by oblio on Wednesday March 23, 2016 @07:02AM (#11343370)

Version ranges can create inconsistent builds. That's why they're not default and that's why they're not really recommended.

[ Parent | on HN ]