Fix: Regenerate PGP Rings - #597
Merged
Merged
Conversation
The existing verification-keyring.keys file contained PGP keys with corrupted or incompatible signature packets that caused ClassCastException errors when Gradle 7.x attempted to verify dependencies: class org.bouncycastle.openpgp.PGPCompressedData cannot be cast to class org.bouncycastle.openpgp.PGPSignatureList This is a known issue with Gradle 7.x's BouncyCastle PGP processing when encountering certain key formats. Resolution: - Removed old keyring file and cleared verification cache - Regenerated fresh PGP keys using --refresh-keys and --export-keys flags - Updated verification-metadata.xml with current dependency signatures This fix ensures dependency verification works correctly for PRs that update package versions.
The previous regeneration missed keys needed for buildscript dependencies like junit-bom. Regenerated with a full build to capture all dependencies including those used in the build configuration. This ensures CI/CD passes with strict dependency verification.
After merging from main, the verification metadata was missing checksums for Gradle .module files (e.g., junit-bom-5.9.3.module) which are used alongside .pom files in modern Gradle dependency resolution. Regenerated verification metadata to include both .pom and .module file checksums for all dependencies.
Previous attempts had incomplete metadata that was missing: - .module files for okhttp, okio, junit-bom - Trusted keys for javax.activation artifacts - Keys for javax.xml.bind artifacts Performed full clean regeneration: - Removed all existing verification files and Gradle cache - Regenerated with --write-verification-metadata pgp,sha256 - Used full build to capture all runtime and buildscript dependencies - Verified locally with strict dependency verification This resolves all CI verification failures.
Added trusted keys for: - javax.xml.bind artifacts (key 70cd19bfd9f6c330027d6f260315bfb7970a144f) - net.java artifacts (key 2bcbdd0f23ea1cafcc11d4860374cf2e8dd1bdfd) - com.squareup.okio (added to existing Square key dbd744ace7ade6aa) Added ignored key: - javax.activation (key 6425559c47cc79c4) - couldn't be downloaded These keys were in the keyring but not marked as trusted in the verification metadata, causing CI to fail with 'key isn't in your trusted keys list' errors.
gschueler
approved these changes
Jan 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix: Regenerate PGP Keyring to Resolve Gradle 7.x Verification Errors
Problem
Multiple PRs have been failing with the following error during dependency verification:
This error occurs when running:
Root Cause
The existing verification-keyring.keys file contained PGP keys with corrupted or incompatible signature packets. This is a known issue with Gradle 7.x's BouncyCastle PGP processing when encountering certain PGP key formats (specifically compressed signature packets).
Solution
Regenerated the PGP keyring from scratch by:
Removing the corrupted keyring file
Clearing Gradle's dependency verification cache
Using --refresh-keys and --export-keys flags to download fresh keys
Updated verification-metadata.xml with current dependency signatures
Testing
Verified the fix by running the previously failing command successfully:
Impact
Fixes dependency verification failures on PRs with package updates
No changes to actual dependencies or build logic
Only regenerates verification metadata with clean PGP keys
Future Considerations
This keyring will need periodic regeneration when:
New dependencies are added
PGP signing keys expire or are revoked
Upgrading to Gradle 8+ would permanently resolve this issue (recommended for long-term)