Nexus Professional allows validation of PGP signed artifacts, and can block access based on the results of that check. PGP support helps you guard your builds against corrupted or intentionally tampered artifacts in an automatic and transparent way.
How Artifacts are Signed
Most artifacts being added to the Maven Central Repository are signed during the release process using the maven-gpg-plugin. The GPG plugin is an implementation of the PGP public-key cryptography algorithm. Artifacts are signed by calculating a hash of the artifact that is then encrypted with that user’s private key. This digitally signed hash is added to the repository alongside the original file as an .ASC file.
Developers normally publish their keys to a public key server such as pgp.mit.edu
Signed artifacts are validated by inspecting the .ASC file to determine the key ID used to sign the artifact. Public key is then retrieved from a configurable list of public keystores and the decrypted hash is then compared to the recalculated hash of the artifact. If they match, then you know the artifact hasn't been tampered with or corrupted.
Verifying PGP Signatures with Nexus Professional
Nexus performs signature checks on the fly via the Procurement support. Rules can be defined based on the group/artifact/version (with wildcards) allowing you to approve only artifacts with valid signatures and block those that are invalid. Nexus also allows you to configure how to handle missing signatures.
Future releases of Nexus will build upon the signature checking to provide the ability to scan entire repositories and report on the signature status, as well as manage the web of trust so that you can block artifacts signed by people you don’t yet trust.