Hi all, quick question about the Maven Central release signing key. We verify dependency signatures with Gradle. Since 3.5.4, org.wiremock:wiremock has been signed by "WireMock Release Bot release-bot@wiremock.org", fingerprint 0A4A A2D7 C605 3AB0 68D2 06AA 4692 A312 EF60 0C15. The key points to the wiremock/community docs, but I couldn't find the fingerprint there. Can someone confirm this is the official release key? Could it also be published somewhere official? Thanks!

Hi Daniel, I believe this is the official key, but will confirm. Good shout about publishing it somewhere official, we’ll do that.

Great, thanks!

Ah, I’d forgotten - we do publish the key here if this is any help: keys.openpgp.org/search?q=release-bot%40wiremo…

Yes, that's in the direction of my initial request. As anyone can upload to a key, the trust of a key need to be verified by some means. This is also what the Gradle and Apache documentation states:

Always verify keys against official sources.

docs.gradle.org/current/userguide/dependency_verification.html#…

Do not trust a key just because it has been downloaded from a key server.

infra.apache.org/release-signing.html#…