Where can I find up to date PGP key used to sign artifacts published to Central?

[pzygielo]

I have consulted hkps://pgp.surfnet.nl hkps://keyserver.ubuntu.com hkps://keys.openpgp.org hkps://pgpkeys.eu and this is the key received:

pub   rsa4096 2020-03-12 [C] [expired: 2024-03-07]
      76DBA0D142FE15D6A16F6B3789AF105CEEC705A4
uid           [ expired] Neo4j <[email protected]>
sub   rsa4096 2020-03-12 [S] [expired: 2024-03-07]
      07A4FA67A8222F1B39F9EDAEF8052E4E1BD0DB31
sub   rsa4096 2020-04-08 [E] [expired: 2024-03-07]
      D4FD735E618E3CF99D890E3EA7A66BE60A24CE10

(note the expired date).

However, while checking signature I am getting:

$ gpg --verify org/neo4j/driver/neo4j-java-driver/5.28.2/neo4j-java-driver-5.28.2.jar.asc org/neo4j/driver/neo4j-java-driver/5.28.2/neo4j-java-driver-5.28.2.jar
gpg: Signature made Mon 03 Mar 2025 16:39:58 CET
gpg:                using RSA key 07A4FA67A8222F1B39F9EDAEF8052E4E1BD0DB31
gpg: Good signature from "Neo4j <[email protected]>" [expired]
gpg: Note: This key has expired!

(note the date that signature was made on).

Question: Where can I find up to date PGP key used to sign artifacts published to Central?

[injectives]

Hi @pzygielo.

I have been told that it was fixed in early April. Would you be able to check again please?

Thanks.

[pzygielo]

Thanks for checking.
I do confirm that the key looks fine:

pub   rsa4096 2020-03-12 [C] [expires: 2026-02-12]
      76DBA0D142FE15D6A16F6B3789AF105CEEC705A4
uid           [  full  ] Neo4j <[email protected]>
sub   rsa4096 2020-03-12 [S] [expires: 2026-02-12]

🎉