4 ms·

That's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really i

That's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really identify the author.

brianefox 12y ago
Fwiw, Bintray requires the private key and passphrase to do the signing. This isn't really proper key handling and has been pointed out before.
- jbaruch_s 12y ago
  Brian, how ignorant of you (again). The docs on signing are public, you could read before spreading FUD.