ARTIFACTORY: Managing and Understanding Signing Keys in Artifactory

For this article, we want to understand the use and setup for signing and verifying Artifactory generated artifacts. Artifactory will not and cannot sign for packages it does not create.  Artifactory generates its own metadata files for all packages so that is what we can sign for RPM and Debian repositories. 

Signing metadata 

Under the Artifactory -> Security -> Keys Management, we can start by looking to the Signing Keys tab.  To create and upload the GPG Keys, we can look at the documentation.

Now, what will this actually achieve?  For RPM repositories, we will need to navigate to the specific repositories and select the GPG Key Pair we have configured to be used when signing the metadata files Artifactory generates.  With this, once the metadata is generated, we expect to see the created Release file and now will see the signed Release.gpg.  This is Artifactory confirming this Release file has not been manipulated in any way from the generated metadata.

The same applies for Debian.  We will select the GPG Key Pair for the specific repositories and now expect to see the repodata.xml and the newly generated repodata.xml.asc.

Signing Release Bundles

Under the same Keys Management page, we will need to add the GPG Key to the Public Keys tab.  We can look to the following REST API to add and propagate the private and public keys to Distribution, source Artifactory and target Edge node (read more).

Once we add the GPG Key and propagate it to all nodes, we can then look to Distribution where we can Create or Create and Sign the Release Bundle.  As mentioned in our documentation, if we generate the GPG Key with a passphrase, we will not be able to regenerate a passphrase or recover this passphrase.  In the case of losing this passphrase, we would need to generate a new GPG Key.