News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by renewiltord on Sunday July 26, 2020 @02:43PM (#23959159)
There's a human in the loop when you get your Maven Central account that lets you publish your jar under some prefix.
[ Parent | on HN ]
Re:Signing .jars is not worth the effort by CamouflagedKiwi on Sunday July 26, 2020 @04:38PM (#23960013)
That's orthogonal to the PGP signing though. That verifies that you control the domain for the Maven group id but doesn't need any PGP keys (it's more akin to the process of verifying DNS records for SSL certificates).
[ Parent | on HN ]
Re:Signing .jars is not worth the effort by renewiltord on Monday July 27, 2020 @09:38PM (#23971408)
It's been a while. You don't have your PGP key countersigned? I don't recall.
[ Parent | on HN ]