java build_error ai_generated true

验证来自中央仓库的工件 com.example:signed-lib:1.0.0 的 PGP 签名失败：签名验证失败：没有可用的公钥。

Failed to validate PGP signature for artifact com.example:signed-lib:1.0.0 from repository central: Signature verification failed: No public key available

ID: java/maven-artifact-signature-validation-failure

其他格式: JSON · Markdown 中文 · English
80%修复率
85%置信度
0证据数
2025-03-05首次发现

版本兼容性

版本状态引入弃用备注
8+ active — — —

根因分析

Maven 配置为验证依赖的签名，但本地密钥环中没有工件签名者的公钥。

English

Maven is configured to verify signatures of dependencies, but the public key for the artifact's signer is not in the local keyring.

generic

解决方案

  1. 90% 成功率 Import the correct public key from a keyserver 
    gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY_ID
  2. 80% 成功率 Configure Maven to skip signature verification for that specific repository 
    <repository><id>central</id><url>https://repo.maven.apache.org/maven2</url><snapshots><checksumPolicy>ignore</checksumPolicy></snapshots></repository> (set checksumPolicy to 'ignore' for signatures)

无效尝试

常见但无效的做法:

  1. Disabling signature verification globally in settings.xml 70% 失败

    This reduces security and may not be allowed in corporate environments.

  2. Importing a random public key from a keyserver 90% 失败

    The imported key may not match the signer, leading to continued verification failure.