Hi After some back and forth I figured out:
- Maven was using a different GPG Key - My Apache GPG Key had a sub key which might have caused issues I verified that when I signed a maven file that the .asc file has the right fingerprint (gpg <file path>). So I redid the release and verified on my laptop that the signature was good. Hope that works now. - Andy > On Mar 31, 2023, at 7:42 AM, Radu Cotescu <r...@apache.org> wrote: > > Hi Andy, > >> On 31 Mar 2023, at 11:06, Stefan Seifert <stefan.seif...@diva-e.com.INVALID> >> wrote: >> >> i tried multiple times yesterday and today to validate the new release, but >> the GPG validation is still failing for me, although i've downloaded the >> updated KEYS [1] file in the same way it worked for all the other keys. > > Same issue like Stefan and I’m using the Committer CLI tool [2] to verify > releases. This always downloads the KEYS file before verifying. Here’s the > output: > >> Signature org.apache.sling.graphql.core-0.0.18-javadoc.jar.asc was not >> generated with any of the known keys. > > > Therefore I guess you need to cancel this release as well. I could start the > release for you, if you want, until you can figure out what went wrong with > your GPG setup. Just let me know (either by replying here or by actually > cancelling the previous release threads). > > Thanks, > Radu > > [2] - https://github.com/apache/sling-org-apache-sling-committer-cli
