Expired PGP key is being used to sign releases
Discovered this while doing a full audit of a project's dependencies in order to enforce strict checksum and signature verification per https://docs.gradle.org/current/userguide/dependency_verification.html
Looking at the signature available for resilience4j 2.4.0 released in March 2026 ( https://repo.maven.apache.org/maven2/io/github/resilience4j/resilience4j-core/2.4.0/resilience4j-core-2.4.0.jar.asc ), it was signed with key ID 3FFA7DB1EC0FF1A2
❯ gpg --list-packets resilience4j-core-2.4.0.jar.asc
# off=0 ctb=89 tag=2 hlen=3 plen=412
:signature packet: algo 1, keyid 3FFA7DB1EC0FF1A2
version 4, created 1773496695, md5len 0, sigclass 0x00
digest algo 10, begin of digest d0 13
hashed subpkt 2 len 4 (sig created 2026-03-14)
subpkt 16 len 8 (issuer key ID 3FFA7DB1EC0FF1A2)
data: [3072 bits]The public key can be found at either:
- https://keys.openpgp.org/vks/v1/by-fingerprint/94FAC9D5B165E80F1F2D9A103FFA7DB1EC0FF1A2
- https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x94FAC9D5B165E80F1F2D9A103FFA7DB1EC0FF1A2
And inspecting it you can see that it expired back in 2023:
❯ gpg --show-keys --with-fingerprint 94fac9d5b165e80f1f2d9a103ffa7db1ec0ff1a2.asc
pub rsa3072 2021-05-21 [SC] [expired: 2023-05-21]
94FA C9D5 B165 E80F 1F2D 9A10 3FFA 7DB1 EC0F F1A2
uid Robert Winkler
sub rsa3072 2021-05-21 [E] [expired: 2023-05-21]
gpg: WARNING: No valid encryption subkey left over.Opening this issue because I couldn’t find an existing report, and it should be a straightforward fix so future releases can validate cleanly under strict signature verification.
Source: resilience4j/resilience4j