构件签名与安全验证

GPG 签名验证构件完整性。

GPG 配置

安装 GPG

# Linux
apt-get install gnupg

# Windows
下载 Gpg4win

生成密钥

gpg --gen-key

Maven 配置

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-gpg-plugin</artifactId>
  <version>1.6</version>
  <executions>
    <execution>
      <phase>verify</phase>
      <goals>
        <goal>sign</goal>
      </goals>
    </execution>
  </executions>
</plugin>

settings.xml 配置

<profile>
  <id>gpg</id>
  <properties>
    <gpg.executable>gpg</gpg.executable>
    <gpg.passphrase>${env.GPG_PASSPHRASE}</gpg.passphrase>
  </properties>
</profile>

要点总结

• gpg --gen-key 生成密钥
• maven-gpg-plugin 签名构件
• verify 阶段执行签名
• GPG_PASSPHRASE 环境变量传入密码