DEV Community

Vladislav Kochetov
Vladislav Kochetov

Posted on Edited on

How to set up publication signature with the Gradle plugin

#gradle #gpg #signing #nexus

Introduction:

In the realm of software development, ensuring the security and integrity of your artifacts is of paramount importance. One effective approach is to sign your artifacts using GPG (GNU Privacy Guard) keys. This article will guide you through the process of setting up GPG, generating keys, and utilizing The Signing Plugin to sign artifacts before publishing them to Nexus.

1. Installing GPG:

To begin, let's install GPG on our system. Follow the instructions below:

Linux:
- Open a terminal window.
- Execute the command: sudo apt-get install gnupg

macOS:
- Open a terminal window.
- Run the command: brew install gnupg

Windows:
- Download the Gpg4win installer from the Gpg4win website.
- Run the installer and follow the on-screen instructions.

2. Generating GPG Keys:

Once GPG is installed, let's generate GPG keys. These keys will be used to sign your artifacts. Follow these steps:

  • Open a terminal or command prompt.
  • Execute the command: gpg --full-generate-key
  • Follow the interactive prompts to configure your key, such as selecting the key type and size.
  • Set a strong passphrase for your key. Remember this passphrase as you will need it later.
  • Once the key generation is complete, your GPG key pair will be stored in the GPG keyring.

3. Configuring The Signing Plugin:

  • Open the build.gradle file of your project.
  • Add the following lines to the top of the file: 
   plugins {
       id 'signing'
   }
Enter fullscreen mode Exit fullscreen mode
  • Configure the signing plugin for root project: 
   signing {
       sign publishing.publications
   }
Enter fullscreen mode Exit fullscreen mode
  • Provide the GPG key details in gradle.properties: 
signing.keyId=YOUR_KEY_ID
signing.secretKeyRingFile=~/.gnupg/secring.gpg
signing.password=YOUR_PASSPHRASE
Enter fullscreen mode Exit fullscreen mode

Note:

  • To get the keyId, you can run the following command gpg --list-keys --keyid-format short and take the 8-digit value
  • The secring.gpg file has been removed in GPG 2.1. However, GPG still can create such a file: gpg --export-secret-keys -o secring.gpg
  • To upload your public key to the keyserver, you can use the following command gpg --keyserver hkp://keyserver.ubuntu.com --send-keys YOUR_KEY_ID

4. Publish with signing:

./gradlew publishToMavenLocal
./gradlew publish

Sep 28, 2026 Update: GitHub Actions + Maven Central

The original article uses secring.gpg. For GitHub Actions, it is easier and safer to use an in-memory GPG key and Maven Central secrets.

1. Open the Maven Central Portal:

https://central.sonatype.com/

Go to Account → Generate User Token and save:

MAVEN_CENTRAL_USERNAME
MAVEN_CENTRAL_PASSWORD
Enter fullscreen mode Exit fullscreen mode

2. Export your private GPG key: 

gpg --armor --export-secret-keys YOUR_KEY_ID
Enter fullscreen mode Exit fullscreen mode

Copy the complete:

-----BEGIN PGP PRIVATE KEY BLOCK-----
...
-----END PGP PRIVATE KEY BLOCK-----
Enter fullscreen mode Exit fullscreen mode

3. Add these GitHub repository secrets under:

Settings → Secrets and variables → Actions

MAVEN_CENTRAL_USERNAME
MAVEN_CENTRAL_PASSWORD
SIGNING_KEY
SIGNING_PASSWORD
Enter fullscreen mode Exit fullscreen mode

Where:

  • MAVEN_CENTRAL_USERNAME — username from the Maven Central User Token
  • MAVEN_CENTRAL_PASSWORD — password from the Maven Central User Token
  • SIGNING_KEY — the complete ASCII-armored private GPG key exported with gpg --armor --export-secret-keys YOUR_KEY_ID
  • SIGNING_PASSWORD — the passphrase you set when creating the GPG key

4. Pass them to Gradle in GitHub Actions: 

- name: Publish to Maven Central
  run: ./gradlew publishAndReleaseToMavenCentral
  env:
    ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
    ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
    ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
    ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
Enter fullscreen mode Exit fullscreen mode

With this approach, secring.gpg is not required in CI.

Top comments (0)