Output a report or text file of the verification

[mgrilvaca]

Is your feature request related to a problem? Please describe.
Currently when running the plugin, the only way to see what was verified is in the command prompt window and to archive it by copying and pasting it into a document or outputting the results with the entire maven logging.

Describe the solution you'd like
When running the plugin, I'm looking for a way to output a report or even a text file to easily show the PGP verification of each dependency.

Describe alternatives you've considered
An even cooler approach would be to implement it within the maven site plugin to run in the reporting portion of maven. For instance, running "mvn site" would include a report of the pgpverify results.

Thank you!

[slawekjaranowski]

My proposition in this step is produce report in json format, it will be ease to parse in next step.

Next steps which consume raport will be:

• maven site generator
• generating keysMap file Goal for generating keys map file #84

First we should confirm what data of verification process we want store for next steps.

My proposition:

[
    {
        "group": "groupId",
        "artefact": "artefactId",
        "packaging": "packaging",
        "version": "version of artefact",
        "key": {
            "finger": "key FingerPrint",
            "master": "master key FingerPrint",
            "uid": ["uid1", "uid2"] 
        },
        "signature": {
            "hash": "hash algorithm",
            "key": "key algorithm",
            "date": "date of signature",
            "status": "signature validation status"
        }
    }
]

[cobratbq]

A few suggestions:

1. field name artefact --> artifact (typo)
2. I would change finger to fingerprint ... as it isn't a real abbreviation and this way it just reads nicer.
3. Would it be possible to include the public key status? (valid, expired, revoked)
4. In case of missing signature: field signature with null? (Same for field key.)

[slawekjaranowski]

Please see: #169 report can contain information similar to show mojo.