{
  "id": "java/maven-artifact-signature-validation-failure",
  "signature": "Failed to validate PGP signature for artifact com.example:signed-lib:1.0.0 from repository central: Signature verification failed: No public key available",
  "signature_zh": "验证来自中央仓库的工件 com.example:signed-lib:1.0.0 的 PGP 签名失败：签名验证失败：没有可用的公钥。",
  "regex": "Failed\\ to\\ validate\\ PGP\\ signature\\ for\\ artifact\\ com\\.example:signed\\-lib:1\\.0\\.0\\ from\\ repository\\ central:\\ Signature\\ verification\\ failed:\\ No\\ public\\ key\\ available",
  "domain": "java",
  "category": "build_error",
  "subcategory": null,
  "root_cause": "Maven is configured to verify signatures of dependencies, but the public key for the artifact's signer is not in the local keyring.",
  "root_cause_type": "generic",
  "root_cause_zh": "Maven 配置为验证依赖的签名，但本地密钥环中没有工件签名者的公钥。",
  "versions": [
    {
      "version": "8+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Disabling signature verification globally in settings.xml",
      "why_fails": "This reduces security and may not be allowed in corporate environments.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    },
    {
      "action": "Importing a random public key from a keyserver",
      "why_fails": "The imported key may not match the signer, leading to continued verification failure.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Import the correct public key from a keyserver",
      "success_rate": 0.9,
      "how": "gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY_ID",
      "condition": "",
      "sources": []
    },
    {
      "action": "Configure Maven to skip signature verification for that specific repository",
      "success_rate": 0.8,
      "how": "<repository><id>central</id><url>https://repo.maven.apache.org/maven2</url><snapshots><checksumPolicy>ignore</checksumPolicy></snapshots></repository> (set checksumPolicy to 'ignore' for signatures)",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": null,
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2025-03-05",
  "last_confirmed": "2025-01-01",
  "last_updated": "2025-01-01",
  "evidence_count": 0,
  "tags": [],
  "locale": "en",
  "aliases": []
}