Validate Hibernate Extension Artifact Signatures

For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

Validate Hibernate Extension Artifact Signatures

Overview

You can validate the signature of a MongoDB Extension for Hibernate ORM artifact that MongoDB publishes to Maven Central. Validating an artifact signature helps you confirm that the artifact is authentic and unmodified.

Procedure

These steps describe how you can validate Hibernate ORM extension artifact signatures.

  1. Install encryption software

You must install the GnuPG encryption suite to validate artifact signatures from the command line.

On macOS, you can install GnuPG by using Homebrew:

bash brew install gnupg

Tip:

You can also install GPG Suite, which provides a graphical interface for GnuPG. There is a Homebrew installation for GPG Suite.

  1. Download and import the MongoDB signing key

Download and import the public key that MongoDB uses to sign the release:

bash gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

You can also find release-specific instructions on the MongoDB Extension for Hibernate ORM releases page.

  1. Download the signed artifact

Download the MongoDB Extension for Hibernate ORM artifact that you want to verify from Maven Central.

The following example downloads version 1.0.0 of the extension:

bash curl -LO https://repo.maven.apache.org/maven2/org/mongodb/mongodb-hibernate/1.0.0/mongodb-hibernate-1.0.0.jar

To verify a different version, replace 1.0.0 in the command with the version that you want to verify.

  1. Download the artifact signature

Download the detached signature file for the same artifact and version:

bash curl -LO https://repo.maven.apache.org/maven2/org/mongodb/mongodb-hibernate/1.0.0/mongodb-hibernate-1.0.0.jar.asc

The .asc file must correspond to the artifact file that you downloaded.

  1. Verify the signature

Run the following command from the directory containing the artifact and its signature:

bash gpg --verify mongodb-hibernate-1.0.0.jar.asc mongodb-hibernate-1.0.0.jar

If the signature is valid, GnuPG prints a message similar to the following:

text gpg: Signature made Wed Sep 16 19:15:35 2026 IST gpg: using RSA key 76E0008D166740A8 gpg: Good signature from "MongoDB Java Driver Release Signing Key <packaging@mongodb.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 1A75 005E 1421 9222 3D6A 7C3B 76E0 008D 1667 40A8

A valid signature confirms that the artifact matches the signed release. Review the key fingerprint and signing identity before trusting the result.

Additional Information

To learn more about verifying signatures, see Verify Integrity of MongoDB Packages in the Server manual.