Verify dependency signatures during build (dropwizard#2667)

https://www.simplify4u.org/pgpverify-maven-plugin/ Refs dropwizard#2664
terezivy · Mar 14, 2019 · 38a750a · 38a750a
1 parent 3830299
commit 38a750a
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/pom.xml b/pom.xml
@@ -288,6 +288,7 @@
             <properties>
                 <maven.javadoc.skip>true</maven.javadoc.skip>
                 <maven.source.skip>true</maven.source.skip>
+                <pgpverify.skip>true</pgpverify.skip>
             </properties>
             <build>
                 <plugins>
@@ -567,6 +568,11 @@
                     <artifactId>sphinx-maven-plugin</artifactId>
                     <version>2.3.1</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.simplify4u.plugins</groupId>
+                    <artifactId>pgpverify-maven-plugin</artifactId>
+                    <version>1.4.0</version>
+                </plugin>
             </plugins>
         </pluginManagement>
 
@@ -674,6 +680,21 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.simplify4u.plugins</groupId>
+                <artifactId>pgpverify-maven-plugin</artifactId>
+                <configuration>
+                    <quiet>true</quiet>
+                    <pgpKeyServer>hkps://keyserver.ubuntu.com</pgpKeyServer>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>