[MNG-5814] Be able to verify the pgp signature of downloaded plugins against a trust configuration

**[Alexander Kjäll](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=capitol)** opened **[MNG-5814](https://issues.apache.org/jira/browse/MNG-5814?redirect=false)** and commented

In order to protect ourself against an attacker that can do injection attacks on our downloads we need to verify the pgp signatures of the downloaded artifacts.

For normal dependencies this can be done with a plugin, for example this one: https://github.com/s4u/pgpverify-maven-plugin/

But it's not possible for a plugin to verify it's own authenticity, as it was downloaded over an possible insecure channel itself.

Therefor we need something preinstalled that verifies that the plugin we downloaded is the same one that was specified in our pom file.

I propose that functionality is added to maven that verifies the jar and pom files against it's pgp signature files for plugins. And some sort of notation is added to the pom file so that it's possible to specify the signing key for a plugin.

---

**Issue Links:**
- [MNG-6026](https://issues.apache.org/jira/browse/MNG-6026) Extend the Project Object Model (POM) with trust information (OpenPGP, hash values)

7 votes, 12 watchers