Signing Release Bundles

ARTIFACTORY: Managing and Understanding Signing Keys in Artifactory

AuthorFullName__c
Scott Mosher
articleNumber
000005366
ft:sourceType
Salesforce
FirstPublishedDate
2022-08-10T07:37:26Z
lastModifiedDate
2022-08-10
VersionNumber
3
Under the same Keys Management page, we will need to add the GPG Key to the Public Keys tab. We can look to the following REST API to add and propagate the private and public keys to Distribution, source Artifactory and target Edge node (read more).

Once we add the GPG Key and propagate it to all nodes, we can then look to Distribution where we can Create or Create and Sign the Release Bundle. As mentioned in our documentation, if we generate the GPG Key with a passphrase, we will not be able to regenerate a passphrase or recover this passphrase. In the case of losing this passphrase, we would need to generate a new GPG Key.