[
https://issues.apache.org/jira/browse/MPOM-118?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15300838#comment-15300838
]
Christopher Tubbs commented on MPOM-118:
----------------------------------------
Publishing a public key to a keyserver is never required, but it's advised,
because that's how others know how to encrypt messages to you.
The reason these preferences are stored inside the public key, and should be
published to a keyserver, is because this communicates to others how you would
prefer to receive messages encrypted with your public key. The key preferences
used are the *recipient's* keys.
In the case of a signature, the "recipient" is you (because you are using your
private key to encrypt, the recipient is persons holding your public key), so
it uses the key preferences in your key.
I don't know if that's the best explanation, but it's what helped me understand
what GPG was doing.
> Enforce strong GPG signatures by default
> ----------------------------------------
>
> Key: MPOM-118
> URL: https://issues.apache.org/jira/browse/MPOM-118
> Project: Maven POMs
> Issue Type: Improvement
> Components: asf
> Affects Versions: ASF-17
> Reporter: Christopher Tubbs
>
> maven-gpg-plugin configuration could be improved a bit so that ASF releases
> are not weakened by a user's weak personal configuration.
> I suggest adding something like the following to maven-gpg-plugin's
> configuration in the pluginManagement section:
> {code:xml}
> <gpgArguments combine.children="append">
> <arg>--digest-algo=SHA512</arg>
> </gpgArguments>
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
