Where can I find up-to-date PGP key used to sign Maven Central artifacts?

[pzygielo]

I'm getting

$ gpg io/cucumber/cucumber-java/7.18.1/cucumber-java-7.18.1.jar.asc
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: assuming signed data in 'io/cucumber/cucumber-java/7.18.1/cucumber-java-7.18.1.jar'
gpg: Signature made Thu 18 Jul 2024 19:02:30 CEST
gpg:                using RSA key E60E1F911B996560FFB135DAF4CABFB5B89B8BE6
gpg: Good signature from "Cukebot <[email protected]>" [expired]
gpg: Note: This key has expired!

with

$ gpg --list-public-keys E60E1F911B996560FFB135DAF4CABFB5B89B8BE6
pub   rsa2048 2018-06-27 [SC] [expired: 2020-06-26]
      E60E1F911B996560FFB135DAF4CABFB5B89B8BE6
uid           [ expired] Cukebot <[email protected]>
sub   rsa2048 2018-06-27 [E] [expired: 2020-06-26]

but signature was made after expiration time.

(Got key from https://keyserver.ubuntu.com)

Propagate updated key to keyservers or point me to proper resource, please.

[mpkorstanje]

Thanks for pointing that out. Looks like the key was not uploaded to the key server after its expiration got extended. Should be fixed now.

[pzygielo]

I confirm: the refreshed key has S-key expiration in the future (expires: 2026-07-06).
Thank you.