docs(release): prefer keys.openpgp.org over keyserver.ubuntu.com#2984
Merged
bjagg merged 3 commits intoMay 13, 2026
Conversation
Problem: the prerequisites step instructed publishing the signing key only to keyserver.ubuntu.com. The Central Publisher Portal queries keys.openpgp.org first; a key on Ubuntu alone can fail signature validation non-deterministically. The Maven ecosystem release guide already corrected this during the 2026 portlet release cycle but the uPortal Gradle guide had drifted out of sync. Goal: bring the uPortal release guide's keyserver instructions in line with the Maven ecosystem guide so operators set up their key once and have it work for both Gradle and Maven publishing. Changes: - replace the single keyserver.ubuntu.com line in prerequisite #4 with the keys.openpgp.org-first instructions used by the Maven guide, including the email-confirmation caveat for identity packets, the optional ubuntu redundancy, the sks-keyservers note, and a per-session curl verification snippet
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/developer/other/RELEASE.mdin line with the Maven portlet release guide, which the 2026 portlet release cycle confirmed as the working sequenceWhy
The Central Publisher Portal queries `keys.openpgp.org` first when validating signatures. A key that's only on `keyserver.ubuntu.com` fails signature validation non-deterministically — sometimes the first release in a session works because of caching, then a subsequent one in the same session fails. The Maven ecosystem release guide had already been corrected during the 2026 portlet release cycle; this PR closes the drift between the two guides so operators only set up their key once and have it work for both Gradle and Maven publishing.
Test plan