OSSRH "Missing signature" (gpg) on Central publish in CI

By Daniel Zoghalchali·Latchkey

Maven Central rejects the staging repository because artifacts lack .asc GPG signatures. The maven-gpg-plugin either did not run in CI or had no key/passphrase, so unsigned files failed the validation rules.

What this error means

The staging repository fails to close with "Missing Signature" for each artifact, or the local build fails with "gpg: signing failed: No secret key" / "No pinentry".

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-gpg-plugin:sign
[ERROR] gpg: signing failed: No secret key
[ERROR] gpg: no default secret key: No secret key

Common causes

No GPG key imported in the CI runner

The signing key is not present on the ephemeral runner, so maven-gpg-plugin has no secret key to sign with.

Missing passphrase or non-interactive gpg failure

gpg cannot prompt in CI; without --batch --pinentry-mode loopback and a passphrase, signing fails and artifacts stay unsigned.

How to fix it

Import the key and sign in batch mode

1. Import the ASCII-armored private key from a secret into the runner keyring.
2. Pass the passphrase to the gpg plugin in loopback mode.
3. Re-run so every artifact gets a .asc signature.

echo "$GPG_PRIVATE_KEY" | gpg --batch --import
mvn -Dgpg.passphrase="$GPG_PASSPHRASE" \
    -Dgpg.pinentryMode=loopback deploy

Configure the gpg plugin arguments

Force loopback pinentry so the plugin never tries to prompt on a headless runner.

<configuration>
  <gpgArguments>
    <arg>--pinentry-mode</arg>
    <arg>loopback</arg>
  </gpgArguments>
</configuration>

How to prevent it

• Store the GPG private key and passphrase as CI secrets.
• Always run gpg in batch/loopback mode on headless runners.
• Verify a .asc exists for each artifact before closing staging.

Frequently asked questions

Related guides

References

• GitHub Actions documentation