Where can I find PGP key used to sign Maven Central artifacts?

[pzygielo]

Example signature: io/github/oshai/kotlin-logging-jvm/7.0.3/kotlin-logging-jvm-7.0.3.jar.asc

gpg: enabled compatibility flags:
gpg: data source: http://pgp.mit.edu:11371
gpg: keyserver receive failed: No data

gpg: enabled compatibility flags:
gpg: data source: http://pgp.surfnet.nl:11371
gpg: keyserver receive failed: No data

gpg: enabled compatibility flags:
gpg: data source: http://185.125.188.26:11371
gpg: keyserver receive failed: No data

gpg: enabled compatibility flags:
gpg: data source: http://keywin.trifence.ch:11371
gpg: keyserver receive failed: No data

gpg: enabled compatibility flags:
gpg: data source: http://pgpkeys.eu:11371
gpg: keyserver receive failed: No data

gpg: enabled compatibility flags:
gpg: data source: http://keys.openpgp.org:11371
gpg: armor header: Comment: 47EB 6836 245D 2D40 E89D  FB41 36D4 E961 8F3A DAB5
gpg: pub  rsa3072/36D4E9618F3ADAB5 2021-11-27  
gpg: key 36D4E9618F3ADAB5: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

[oshai]

I am not sure... where do you usually expect to find it?

[oshai]

I uploaded it: https://keyserver.ubuntu.com/pks/lookup?search=47eb6836245d2d40e89dfb4136d4e9618f3adab5&fingerprint=on&op=index

[pzygielo]

Thanks for trying.

ubuntu serves this:

which is still w/o user id. Maybe the original key has no user id at all.

Compare older key - https://keyserver.ubuntu.com/pks/lookup?search=637B8FB6CD0B57CA1E833E897F083A4AB2AF5107&fingerprint=on&op=index

To clarify - I'm interested in this to succeed:

$ mkdir /tmp/keys
$ gpg --homedir /tmp/keys --keyserver ${KEYSERVER} --recv-keys 36D4E9618F3ADAB5
$ gpg --homedir /tmp/keys io/github/oshai/kotlin-logging-jvm/7.0.3/kotlin-logging-jvm-7.0.3.jar.asc

for any KEYSERVER I'm told to use (of your choice).

If the 36D4E9618F3ADAB5 key has no User ID I see no way to make it work with GPG: https://dev.gnupg.org/T4393#133689

[oshai]

Since I have the private key and the public key seems missing user id, I will try to generate new public key for it.

[oshai]

I created another public key with my name (on the same ubuntu server):

Can you please check if it works now?

[pzygielo]

Can you please check if it works now?

Yes!

$ gpg --keyserver keyserver.ubuntu.com --recv-keys 36D4E9618F3ADAB5
gpg: key 36D4E9618F3ADAB5: public key "Ohad Shai <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg io/github/oshai/kotlin-logging-jvm/7.0.3/kotlin-logging-jvm-7.0.3.jar.asc
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: assuming signed data in 'io/github/oshai/kotlin-logging-jvm/7.0.3/kotlin-logging-jvm-7.0.3.jar'
gpg: Signature made Sat 30 Nov 2024 22:03:28 CET
gpg:                using RSA key 36D4E9618F3ADAB5
gpg: Good signature from "Ohad Shai <[email protected]>"

Thank you!