package-url / package-url/packageurl-java
Add key to PGP keys map
Open
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 48
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
Maven Central requires all published artifacts to be signed using PGP. If a publisher provides their key ID to PGP keys map then end users can use the Verify PGP signatures plugin to validate that the artifact has not been altered or replaced as part of a supply-chain attack.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is named. Start by confirming the publisher's PGP key ID and the contribution process for the linked PGP keys map. Done means the package publisher's key is added there so users can verify published artifacts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100