I have a number of open source projects in Java and Clojure that I build using Maven and deploy to a public repository (clojars.org). I’m using Eclipse as an IDE, git / GitHub for source control, Windows 7 as OS, and PuTTY / pageant for my keys.
This works well, but I’d like to ensure that I follow best practices and sign all of my artifacts so that others can trust them, and also so that I can verify that the artifacts have not been tampered with.
What are the key steps I should take to ensure all my artifacts are correctly signed and verified? Ideally I’d like this to be well integrated into the Maven build process so that I don’t have to follow additional manual steps.
The Maven GPG plugin docs are good starting points for artifact signing.