Re: Maven Repository Security issues: any war stories?

2020-02-29 Thread Elliotte Rusty Harold
On Sat, Feb 29, 2020 at 2:55 AM Slawomir Jaranowski wrote: > > Hi, > > In maven world all artifacts have pgp signature which is created by current > maintainer (from some time pgp signature is required on Maven Central). > > You can verify signatures of all your dependencies, you can also track >

Re: Maven Repository Security issues: any war stories?

2020-02-29 Thread Slawomir Jaranowski
You are right, native method from maven does not support verifying of pgp signature. For pgpverify-maven-plugin you can prepare configuration file which contains mapping artifact gav to pgp key fingerprint. Without this configuration any existing key is good. >From some time I try to collect whic

[GitHub] [maven-doxia] minfrin opened a new pull request #19: [DOXIA-607] Add support for Xhtml5 keygen tag

2020-02-29 Thread GitBox
minfrin opened a new pull request #19: [DOXIA-607] Add support for Xhtml5 keygen tag URL: https://github.com/apache/maven-doxia/pull/19 This will allow maven generated documentation to include a demo of the keygen tag, as with other form elements. -