[java-mvn-enforcer-data] 01/02: Add a note about how to make local signatures

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch main
in repository java-mvn-enforcer-data.

View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer-data.git;a=commit;h=10e248557fa5082646e1a46ddf1e7c6f6f04e535

commit 10e248557fa5082646e1a46ddf1e7c6f6f04e535
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Fri Mar 31 10:59:25 2023 +0100

    Add a note about how to make local signatures
---
 .../mvn/enforcer/data/localSignatures/README.md    | 24 ++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/main/resources/net/shibboleth/mvn/enforcer/data/localSignatures/README.md b/src/main/resources/net/shibboleth/mvn/enforcer/data/localSignatures/README.md
new file mode 100644
index 0000000..5c6e28c
--- /dev/null
+++ b/src/main/resources/net/shibboleth/mvn/enforcer/data/localSignatures/README.md
@@ -0,0 +1,24 @@
+# Making local signatures
+
+This directory contains local signatures made by Shibboleth project
+committers to allow verification of artifacts for which vendor
+signatures are not available.
+
+One reason this might be required is for Spring Project pre-release (milestone
+and release candidate) artifacts, which are not signed.
+
+To use this facility, create an ASCII-armored detached signature for the
+artifact:
+
+```shell
+gpg --armor --detach-sig spring-webflow-3.0.0-RC1.jar
+```
+
+This will generate a signature in a file named the same as the artifact
+but with `.asc` appended, in the above example `spring-webflow-3.0.0-RC1.jar.asc`.
+
+Copy the signature into this directory. Don't forget to add your signing key,
+at least temporarily, into the keyring file for the artifact's group.
+
+Don't forget to *remove* your key from the keyring, and remove the
+temporary signatures from this directory, when they are no longer needed.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.