3 ms·

So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verify

by wst_ 7y ago

So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verifying key for you. They will check if your key belongs to you and you are in control of your organization. Otherwise package would not be accepted. I may be wrong but source and javadoc are requirements. Maybe there are some old packages without it, but new ones should be complete.

CamouflagedKiwi 7y ago
Maybe they're historic and now it's a requirement, or maybe it's prereleases or something, but I have certainly seen some in the past. First one I can dig up: https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.0.0-beta-3/ https://repo1.maven.org/maven2/com/google/protobuf/protobuf-... The newer versions certainly do have sources and javadoc, but you can't assume their presence for everything.