# Failed to validate PGP signature for artifact com.example:signed-lib:1.0.0 from repository central: Signature verification failed: No public key available

- **ID:** `java/maven-artifact-signature-validation-failure`
- **Domain:** java
- **Category:** build_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Maven is configured to verify signatures of dependencies, but the public key for the artifact's signer is not in the local keyring.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 8+ | active | — | — |

## Workarounds

1. **Import the correct public key from a keyserver** (90% success)
   ```
   gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY_ID
   ```
2. **Configure Maven to skip signature verification for that specific repository** (80% success)
   ```
   <repository><id>central</id><url>https://repo.maven.apache.org/maven2</url><snapshots><checksumPolicy>ignore</checksumPolicy></snapshots></repository> (set checksumPolicy to 'ignore' for signatures)
   ```

## Dead Ends

- **Disabling signature verification globally in settings.xml** — This reduces security and may not be allowed in corporate environments. (70% fail)
- **Importing a random public key from a keyserver** — The imported key may not match the signer, leading to continued verification failure. (90% fail)