# 验证来自中央仓库的工件 com.example:signed-lib:1.0.0 的 PGP 签名失败：签名验证失败：没有可用的公钥。

- **ID:** `java/maven-artifact-signature-validation-failure`
- **领域:** java
- **类别:** build_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

Maven 配置为验证依赖的签名，但本地密钥环中没有工件签名者的公钥。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 8+ | active | — | — |

## 解决方案

1. **Import the correct public key from a keyserver** (90% 成功率)
   ```
   gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY_ID
   ```
2. **Configure Maven to skip signature verification for that specific repository** (80% 成功率)
   ```
   <repository><id>central</id><url>https://repo.maven.apache.org/maven2</url><snapshots><checksumPolicy>ignore</checksumPolicy></snapshots></repository> (set checksumPolicy to 'ignore' for signatures)
   ```

## 无效尝试

- **Disabling signature verification globally in settings.xml** — This reduces security and may not be allowed in corporate environments. (70% 失败率)
- **Importing a random public key from a keyserver** — The imported key may not match the signer, leading to continued verification failure. (90% 失败率)