Maven Central deploy "Missing signature" (GPG) in CI

By Daniel Zoghalchali·Latchkey

Maven Central requires a detached GPG signature (.asc) for every published artifact: the jar, the POM, the sources jar, and the javadoc jar. The validation fails because the gpg signing plugin did not run, or the signing key was not available in CI.

What this error means

Central validation reports "Missing signature for file: <artifact>.jar" or the deploy fails during signing with "gpg: signing failed: No secret key" / "No pinentry".

maven

[ERROR] Failed to deploy: validation failed
  Missing signature for file: lib-1.0.0.jar
  Missing signature for file: lib-1.0.0.pom

Common causes

The GPG signing plugin never ran

The maven-gpg-plugin is not bound to the deploy/verify phase (or its profile is inactive), so no .asc files are produced.

The signing key is not imported in CI, or pinentry blocks it

"No secret key" means the private key was never imported on the runner; pinentry errors come from gpg trying to prompt interactively in a headless job.

How to fix it

Import the key and sign in batch mode

Import the secret key from a CI secret and configure gpg to run non-interactively (loopback pinentry) so signing works headless.

Terminal

echo "$GPG_PRIVATE_KEY" | gpg --batch --import
- run: mvn -B deploy -Dgpg.passphrase="$GPG_PASSPHRASE"

Bind maven-gpg-plugin and pass loopback

Ensure the plugin signs during the verify phase and uses loopback pinentry so it never prompts.

pom.xml

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-gpg-plugin</artifactId>
  <configuration>
    <gpgArguments>
      <arg>--pinentry-mode</arg><arg>loopback</arg>
    </gpgArguments>
  </configuration>
</plugin>

How to prevent it

Import the GPG secret key from a CI secret before deploy.
Use --batch and loopback pinentry so signing never prompts.
Verify all four artifacts (jar, pom, sources, javadoc) are signed.

Frequently asked questions

What causes ""Missing signature for file""?