ci: sign releases with the new release key, and check secrets first

.github/workflows/keploy-junit5-release.yml

@@ -15,7 +15,8 @@ name: keploy-junit5 release
 # modules, and never this one. This workflow signs and deploys with the same
 # key and the same secret names as release.yml: CENTRAL_USERNAME and
 # CENTRAL_PASSWORD (a Central Portal user token for the io.keploy namespace),
-# MAVEN_GPG_PRIVATE_KEY (the ASCII-armored release key, id 8541784E4EC36FB8)
+# MAVEN_GPG_PRIVATE_KEY (the ASCII-armored release key, id F844278E3B5F9051,
+# fingerprint 0167FEA3204A35D8C1E11EE9F844278E3B5F9051)
 # and MAVEN_GPG_PASSPHRASE. A step below fails, naming each one that is not
 # set, before anything is built or signed.
 # Every action this workflow runs, the rows' included, is pinned by commit:
@@ -56,7 +57,7 @@ jobs:
     timeout-minutes: 150
     env:
       # The public key id of keploy's release signing key, as release.yml.
-      GPG_KEY_ID: 8541784E4EC36FB8
+      GPG_KEY_ID: F844278E3B5F9051
     defaults:
       run:
         shell: bash # -eo pipefail: a failed command before a pipe fails the step

.github/workflows/release.yml

@@ -50,7 +50,7 @@ jobs:
     env:
       # Public key id of the Keploy release signing key. Selects the right
       # secret key when more than one is present in the keyring.
-      GPG_KEY_ID: 8541784E4EC36FB8
+      GPG_KEY_ID: F844278E3B5F9051
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -84,6 +84,28 @@ jobs:
           fi
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
+      - name: Check the release secrets are set
+        # Fail before anything is built or signed, naming each secret that is
+        # missing (as keploy-junit5-release.yml does). Without it a missing
+        # private key surfaced only as maven-gpg-plugin's "No secret key"
+        # (setup-java skips the import when the secret is empty), and a
+        # missing passphrase as gpg's "No passphrase given".
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        shell: bash
+        run: |
+          missing=()
+          for s in CENTRAL_USERNAME CENTRAL_PASSWORD MAVEN_GPG_PRIVATE_KEY MAVEN_GPG_PASSPHRASE; do
+            [[ -n "${!s}" ]] || missing+=("$s")
+          done
+          if (( ${#missing[@]} )); then
+            echo "::error::the secret(s) ${missing[*]} are not set; refusing to publish"
+            exit 1
+          fi
+
       - name: Set up JDK 17
         uses: actions/setup-java@v4
         with:

SECURITY.md

@@ -6,4 +6,21 @@ We value security for the project very highly. We encourage all users to report
 If you find a security vulnerability in the Keploy project, please report it responsibly by sending an email to hello@keploy.io
 
 At this juncture, we don't have a bug bounty program. We are a small team trying to solve a big problem. We urge you to report any vulnerabilities responsibly
-so that we can continue building a secure application for the entire community.
+so that we can continue building a secure application for the entire community.
+
+## Verifying releases
+
+Every artifact on Maven Central (`io.keploy`) and every `.asc` file on a
+GitHub Release is signed by the Keploy release key:
+
+- Releases from v2.1.3 on: key id `F844278E3B5F9051`, fingerprint
+  `0167 FEA3 204A 35D8 C1E1  1EE9 F844 278E 3B5F 9051`.
+- Releases up to v2.1.1: key id `8541784E4EC36FB8`, fingerprint
+  `D51E 37C1 E5D2 F092 72E3  8869 8541 784E 4EC3 6FB8`.
+
+Fetch the key from keyserver.ubuntu.com and check a file:
+
+```sh
+gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 0167FEA3204A35D8C1E11EE9F844278E3B5F9051
+gpg --verify keploy-sdk-<version>.jar.asc keploy-sdk-<version>.jar
+```