3 ms·
Are packages cryptographically signed by the actual package maintainer or only with the repo owners key?
by rho138 2y ago
Are packages cryptographically signed by the actual package maintainer or only with the repo owners key?
- erikvanoosten 2y agoAs package maintainer you are required to sign the packages with a PGP key. Maven Central also requires that you upload that PGP key (the public part only of course) to one of a few well-known key servers.