René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add info about which gpg signing keys will be used for published artifacts.","articleBody":"### Add info about which gpg signing keys will be used for published artifacts. \n\nLooks like version 4.12 was published with key `D477D51812E692011DB11E66A6EA2E2BF22E0543` ? \n\n\nFor security purposes, it would be great if you were able to publish details (in the project docs) about gpg public keys that are \"valid\" for use when verifying signing artifacts uploaded to maven central.\n\nThis allows for \"out of band\" verification of the expected signing key. \n\nSome examples of other libs publishing their signing keys:\n\nhttps://square.github.io/okhttp/security/security/#verifying-artifacts\nhttps://docs.couchbase.com/java-sdk/current/project-docs/sdk-release-notes.html#verifying-artifacts\n\nhttps://github.com/eclipse/jetty.project/blob/jetty-10.0.x/KEYS.txt\nhttps://downloads.apache.org/commons/KEYS\nhttps://downloads.apache.org/logging/KEYS\n\nhttps://github.com/cbeust/jcommander/blob/4b97c3440347bedb79e374408b8f123cf0ff4fd4/SECURITY.md#gpg-signature-validation\n\nThese keys can be used with [Gradle \"Dependency verification\" ](https://docs.gradle.org/current/userguide/dependency_verification.html)\n\nSee example of real world usage here: \n- https://github.com/androidx/androidx/blob/androidx-main/gradle/verification-keyring.keys\n- https://github.com/androidx/androidx/blob/androidx-main/gradle/verification-metadata.xml\n","author":{"url":"https://github.com/yogurtearl","@type":"Person","name":"yogurtearl"},"datePublished":"2025-06-27T21:37:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/207/java-diff-utils/issues/207"}