Verified Maven Central from GNU Make
Well after the previous post I tried looking at the signature verification step. There isn't too much to it.
define maven_func= bin/lib/$2-$3.jar: mkdir -p bin/lib wget -O $$@ $(CENTRAL)/$(subst .,/,$1)/$2/$3/$2-$3.jar bin/lib/$2-$3.jar.asc: bin/lib/$2-$3.jar wget -O $$@ $(CENTRAL)/$(subst .,/,$1)/$2/$3/$2-$3.jar.asc gpg --batch --verify $$@ $$< || ( rm $$@ ; echo "GPG verification failed, you may need to import the public key." ) setup: bin/lib/$2-$3.jar.asc endef
If it fails you need to import the keys using gpg manually. This might be a bit annoying but otherwise you may as well not bother.
gpg will pass the check if the key simply exists in your key store and ignores any trust setting, but that's just the way gpg works.