Signing key for Gradle artifacts

Gradle aims to sign every artifact it produces, whether the artifact is published to a repository or shipped through its release distribution channel.

This document describes the current key used to sign releases, and preserves earlier keys so older releases remain verifiable.

The same information is also available in the Gradle source repository and the current key can be retrieved from public key servers.

Current key

Key ID: 2887F479B0B9771A
Fingerprint: EA96F38569C044AAEF7FCF732887F479B0B9771A
Created: 2026-08-14
Used for: Publications to artifact repositories under the org.gradle.* groups, like Maven Central or the Plugin Portal and Gradle distribution releases.

Signing is done by a dedicated subkey rather than by the primary key:

Role	Key ID	Fingerprint
Primary (certify)	`2887F479B0B9771A`	`EA96F38569C044AAEF7FCF732887F479B0B9771A`
Signing subkey	`51FBF517CE6D6B80`	`F3FF33E96F18AA62DD580F9651FBF517CE6D6B80`

Importing the key gives you both, so verification works without explicitly naming the subkey.

The full ASCII-armored block is at the bottom of this document, under Public key blocks.

Previous keys

The keys below were used to sign earlier Gradle artifacts. To verify a release that predates the current key, import the appropriate previous key from Previous key blocks at the bottom of this document.

Key ID	Fingerprint	Active from	Status
`E2F38302C8075E3D`	`1BD97A6A154E7810EE0BC832E2F38302C8075E3D`	2022-12-29	Revoked 2026-08-08 (key superseded)

Handling of revoked keys:

A key is superseded revocation means that the key is retired from service, not that its private material was compromised. Signatures made on artifacts while this key was active remain valid.

The preserved blocks below includes the revocation, when relevant, so importing it tells your GPG installation that the key is retired.

You can also fetch any previous key, with its revocation, from keyserver.ubuntu.com:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <fingerprint>

Verification instructions

Trusting the key in dependency verification

If you use Gradle’s dependency verification to verify Gradle’s own artifacts, add a <trusted-key> entry.

Gradle does not currently resolve a subkey to its primary key, so naming the primary fingerprint instead fails with this key is not in your trusted key list. Allowing a primary key to cover its subkeys is tracked in gradle/gradle#37607.

For the current key, use the signing subkey fingerprint, not the primary key one:

<trusted-key id="F3FF33E96F18AA62DD580F9651FBF517CE6D6B80" group="org.gradle"/>

Note: The previous key signed with its primary key, so a <trusted-key> entry naming 1BD97A6A154E7810EE0BC832E2F38302C8075E3D still matches for those releases.

Importing a key

You can import a Gradle signing key into your GPG keyring in one of two ways.

From an ASCII-armored block in this document. Copy the relevant block into a file called gradle_pubkey.asc, then run:

gpg --import gradle_pubkey.asc

From a key server. Fetch by fingerprint. For the current key:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys EA96F38569C044AAEF7FCF732887F479B0B9771A

Note: Use keyserver.ubuntu.com rather than keys.openpgp.org for previous keys. keys.openpgp.org associates an email address with only one key at a time, so verifying maven-publishing@gradle.com for the current key removed that address from the previous key. The previous key is still served there, but without its user ID, and GPG declines such an import with no user ID.

Verifying signatures

Once you’ve downloaded a Gradle JAR or distribution and its corresponding .asc signature file, verify authenticity against the imported key:

gpg --verify <artifact>.asc <artifact>

The following worked example: import the current key, download a distribution and its signature, then verify:

curl -O https://services.gradle.org/distributions/gradle-9.7.1-bin.zip
curl -O https://services.gradle.org/distributions/gradle-9.7.1-bin.zip.asc

gpg --verify gradle-9.7.1-bin.zip.asc gradle-9.7.1-bin.zip

GPG reports a good signature, with a reference to the subkey:

gpg: Signature made mer. 19 août 16:28:22 2026 CEST
gpg:                using RSA key 51FBF517CE6D6B80
gpg: Good signature from "Gradle Inc. <maven-publishing@gradle.com>" [unknown]

The Good signature from "Gradle Inc. <maven-publishing@gradle.com>" line is the result that matters, and the command exits with the status code 0.

If the key is not trusted locally, GPG will also print a warning:

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EA96 F385 69C0 44AA EF7F  CF73 2887 F479 B0B9 771A
     Subkey fingerprint: F3FF 33E9 6F18 AA62 DD58  0F96 51FB F517 CE6D 6B80

The Primary key fingerprint line refers to the primary key.

Trusting a key locally

If you want to resolve the warning gpg: WARNING: This key is not certified with a trusted signature!, you can locally sign the imported Gradle key to suppress it. This tells your GPG installation that you trust the key.

gpg --sign-key <fingerprint>

Replace <fingerprint> with the fingerprint of the key you imported — either the current key or a previous one.

Note: Once a key is trusted, GPG will no longer list the “Primary key fingerprint” line when verifying signatures made by that key.

Public key blocks

Current key

Previous key blocks

Previous key: E2F38302C8075E3D