Verification of signing keys used for published artifacts

[SemedyRabus]

Is there any official documentation about which signing keys (and corresponding fingerprints) are expected to be used for signing Testcontainers Java artifacts?

I could not find this information on testcontainers.org or in the GitHub repository, but having an authoritative list of expected signing keys would make it much easier to verify the authenticity of released artifacts.

For reference, projects such as Apache Commons publish this information via a KEYS file:
https://downloads.apache.org/commons/KEYS

Would it be possible for Testcontainers to provide similar documentation for artifact verification?

[Moufleh1]

Hello,

We consume Testcontainers for Java artifacts from Maven Central and verify the OpenPGP signature of every POM we use before accepting it. Our policy only accepts a signature when the signing key's full fingerprint is confirmed by an official, public source of the publisher.

For the coordinates below we could not find such a source:

Coordinate	Signature created (UTC)	Key algorithm	Hash algorithm	Issuer in signature
org.testcontainers:testcontainers-bom:2.0.5	2026-04-20T17:52:33Z	EdDSA (22)	SHA-1 (2)	key ID E7D88DB8427DE651 only

Our request:

1. A link to a public, permanent statement on your official website or official source repository (for example a KEYS file, a security page, or release documentation) that states the full 40-hex-character fingerprint of the OpenPGP key(s) used to sign the POM files you publish to Maven Central.

2. In that statement, the scope of each key (which groupIds / artifacts it signs) and its validity period, or the dates of any key rotation, so that the signatures on the coordinates listed above can be matched to a specific key.

3. If the key that signed any of the coordinates above is older or has been rotated: a public statement documenting the relationship between the old and the new fingerprint (for example a transition statement signed by both keys), or, if that is not possible, a newly published signature for the affected release made with the current, documented key.

4. A replacement signature with a stronger hash algorithm. The signature on the coordinate above uses SHA-1 (hash algorithm 2). Our policy does not accept SHA-1 signatures, so a published fingerprint alone is not enough for us. We would ask whether a signature made with SHA-256 or SHA-512 can be published for this release (or for the next release, with a public note on when SHA-1 signing stopped).

The signature also carries only the long key ID, not the full fingerprint, so the fingerprint statement in item 1 is needed to match it.

What we can and cannot accept as evidence

• We can only rely on a statement published in an official, public channel of the project (website, official repository file, release notes, or a public issue/discussion answered by a maintainer and then reflected in a permanent page).
• A private reply or an unpublished message cannot be used as evidence. If you answer privately, we would kindly ask you to publish the same confirmation publicly.
• A key retrieved from a public keyserver, or a fingerprint shown only in an example of verification output, is not treated by us as a statement issued by the publisher.

Thank you for your time and for maintaining this project.

Kind regards,
MOUFLEH ABDELJAWAD - AGBHub

[kiview]

@SemedyRabus That would probably be a good thing to introduce. However, I don't expect this to be happening soon. Maybe as part of revisiting our publication pipeline.