[MPOM-118] Enforce strong GPG signatures by default

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: ASF-17
• Fix Version/s: ASF-19
• Component/s: asf
• Assignee: Herve Boutemy
• Reporter: Christopher Tubbs
• Created: 11/May/16 15:11
• Updated: 09/Jul/16 12:22
• Resolved: 09/Jul/16 12:22

Description

maven-gpg-plugin configuration could be improved a bit so that ASF releases are not weakened by a user's weak personal configuration.

I suggest adding something like the following to maven-gpg-plugin's configuration in the pluginManagement section:

<gpgArguments combine.children="append">
  <arg>--digest-algo=SHA512</arg>
</gpgArguments>