31 ms·
We use https://www.simplify4u.org/pgpverify-maven-plugin https://www.simplify4u.org/pgpverify-maven-plugin and a private PGP signing key allowlist, bound to an
by exabrial 2y ago
We use https://www.simplify4u.org/pgpverify-maven-plugin https://www.simplify4u.org/pgpverify-maven-plugin and a private PGP signing key allowlist, bound to an artifact namespace. This immediately cuts down on unknown dependencies from creeping into our build.