ghenzler edited a comment on issue #2: SLING-8029 Retrieve gpg key automatically if it is missing in keyring URL: https://github.com/apache/sling-tooling-release/pull/2#issuecomment-430741971 @rombert Just read through [1] - I think it should be fine (although it would be better if we all had cross-signed keys, at least I haven't done that). Updated the PR to use `--auto-key-retrieve` and to log the gpg error (if there is one, needed to introduce the check for `maven-metadata.xml` for that reason). If we decide to not automatically retrieve the key we can just take out that option, now that the error is logged for the case there is one, it is better self-guiding than before (that was my main problem, I got the message signature "BAD" message when really just the key was missing). [1] https://unix.stackexchange.com/a/356107
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services
