gpg用于签署上传的 jar 或 aar 文件,这里介绍如何使用 iMac 生成gpg秘钥对,并发布到第三方。
如果没有安装gpg,使用brew安装。
➜ brew install gpg
安装gpg后,使用命令gpg --full-generate-key 生成秘钥对,依次输入:用户ID 和邮箱,然后选择Okay,然后输入密码,即可生成秘钥对
➜ gpg --full-generate-key
gpg (GnuPG) 2.4.3; Copyright (C) 2023 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
gpg: directory '~/.gnupg' created
Please select what kind of key you want:
(1) RSA and RSA
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(9) ECC (sign and encrypt) *default*
(10) ECC (sign only)
(14) Existing key from card
Your selection?
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name:
Email address:
Comment:
You selected this USER-ID:
""
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: ~/.gnupg/trustdb.gpg: trustdb created
gpg: directory '~/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '~/.gnupg/openpgp-revocs.d/.rev'
public and secret key created and signed.
pub rsa4096 2025-09-18 [SC]
uid
sub rsa4096 2025-09-18 [E]
在秘钥生成以后,通过下面的命令查看公钥id
➜ ~ gpg --list-key --keyid-format short
[keyboxd]
---------
sec rsa4096/E6A1AD98 2025-09-18 [SC] [expires: 2023-03-23]
E153535XXXXXXXXXXXXXXXXX6A1AD98
uid [ultimate] XXXXXXXXXX <XXXXXXXXXX>
ssb rsa4096/7D71F5FD 2025-09-18 [E]
pub rsa4096/E6A1AD98 2025-09-18 [SC] [expires: 2023-03-23] 里面,rsa4096后面的E6A1AD98就是公钥Id
如果需要把公钥提交到某些系统,可以采用下面的方法查看秘钥对应的公钥值:
➜ .gnupg gpg --armor --export E6A1AD98
-----BEGIN PGP PUBLIC KEY BLOCK-----
上传公钥Id到公网,为了方便后续访问,我同时上传了多个公网:
➜ gpg --keyserver hkp://keyserver.ubuntu.com --send-keys E6A1AD98
gpg: sending key 08587B8CE6A1AD98 to hkp://keyserver.ubuntu.com
➜ gpg --keyserver hkp://keys.gnupg.net --send-keys E6A1AD98
gpg: sending key 08587B8CE6A1AD98 to hkp://hkps.pool.sks-keyservers.net
如果公钥对外发布了,最好再生成一张”撤销证书”,以备以后密钥作废时,可以请求外部的公钥服务器撤销你的公钥
➜ .gnupg gpg --gen-revoke E6A1AD98
sec rsa4096/E6A1AD98 2025-09-18
Create a revocation certificate for this key? (y/N) y
Please select the reason for the revocation:
0 = No reason specified
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
Q = Cancel
(Probably you want to select 1 here)
Your decision?
Enter an optional description; end it with an empty line:
生成的撤销证书要保存好。
如果有些场景需要生产秘钥文件,可以执行命令生成本地的加密私钥文件。
➜ gpg --export-secret-keys -o ~/.gnupg/secring.kbx
对于Android 项目,如果发布到Maven,需要在gradle 脚本增加配置,在项目根目录的 gradle.properties 添加gpg的配置信息,其中signing.secretKeyRingFile 的值为上一步生成的私钥文件的绝对路径。例如:
# gpg信息
signing.keyId=E6A1AD98
signing.password=XXXXXX
signing.secretKeyRingFile=~/.gnupg/secring.kbx