Ensure good security / code signing for builds with Maven + Java + Clojure

Question

I have a number of open source projects in Java and Clojure that I build using Maven and deploy to a public repository (clojars.org). I'm using Eclipse as an IDE, git / GitHub for source control, Windows 7 as OS, and PuTTY / pageant for my keys.

This works well, but I'd like to ensure that I follow best practices and sign all of my artifacts so that others can trust them, and also so that I can verify that the artifacts have not been tampered with.

What are the key steps I should take to ensure all my artifacts are correctly signed and verified? Ideally I'd like this to be well integrated into the Maven build process so that I don't have to follow additional manual steps.

Answer 1

In addition to signing, you need to provide the signatures and public keys somewhere in a place that is not co-located with the Maven repo, e.g. your web site. Otherwise signing does not achieve the goal of raising trust of others, only your own. If I cannot be sure that the signature on the artifact is yours, my trust is not improved.