Flaky CI Failure: Android release publish fails — PGP signature verification rejected by Sonatype

## Flaky CI Failure: Android release publish fails — PGP signature verification rejected by Sonatype **Workflow:** Release **Failed run:** https://github.com/xmtp/libxmtp/actions/runs/25205594104 **Commit:** 3e15f8f3ef068053f49f9571f8d0de81bb9302ca **Failed jobs:** release-android / publish ### Summary The Android nightly release (`4.10.0-nightly.20260501.3e15f8f`) was uploaded to the Sonatype staging repository, but the `:closeSonatypeStagingRepository` Gradle task failed with HTTP 400. Sonatype reported that PGP signature verification failed for all five published artifacts (.aar, -javadoc.jar, .module, .pom, -sources.jar). The deployment was placed into a `Failed` state on the Sonatype side and the repository was not closed or promoted. ### Error Details ``` > Task :closeSonatypeStagingRepository FAILED FAILURE: Build failed with an exception. * What went wrong: Execution failed for task ':closeSonatypeStagingRepository'. > Failed to close staging repository, server at https://ossrh-staging-api.central.sonatype.com/service/local/ responded with status code 400, body: Failed to process request: Deployment reached an unexpected status: Failed pkg:maven/org.xmtp/android@4.10.0-nightly.20260501.3e15f8f?type=aar - Invalid signature for file: android-4.10.0-nightly.20260501.3e15f8f.aar.asc - Failed to verify the PGP signature. Please contact support for assistance. - Invalid signature for file: android-4.10.0-nightly.20260501.3e15f8f-javadoc.jar.asc - Failed to verify the PGP signature. Please contact support for assistance. - Invalid signature for file: android-4.10.0-nightly.20260501.3e15f8f.module.asc - Failed to verify the PGP signature. Please contact support for assistance. - Invalid signature for file: android-4.10.0-nightly.20260501.3e15f8f.pom.asc - Failed to verify the PGP signature. Please contact support for assistance. - Invalid signature for file: android-4.10.0-nightly.20260501.3e15f8f-sources.jar.asc - Failed to verify the PGP signature. Please contact support for assistance. BUILD FAILED in 6m 41s ``` ### Analysis All five `.asc` signature files were rejected by Sonatype Central's verification. This is **not** a transient network failure — the artifacts were successfully uploaded, but Sonatype's GPG key verification step failed for every artifact. Possible root causes: 1. **Expired PGP key**: The signing key stored in CI secrets may have expired and Sonatype's keyservers no longer consider it valid. 2. **Key mismatch**: The PGP key used to sign the artifacts in this run does not match the key registered/published to the keyserver that Sonatype queries. 3. **Secret rotation**: The `GPG_SIGNING_KEY` or equivalent secret in GitHub Actions may have been changed/rotated to a new key that hasn't been published to a public keyserver yet. 4. **Sonatype account key change**: The key registered with the `org.xmtp` Sonatype namespace may have changed. This is a **CI/signing infrastructure failure**, not a code regression. The build and artifact generation succeeded; only the publish step is broken. --- *Reported by [Flaky Failure Watcher](https://github.com/xmtp/libxmtp/blob/main/.github/workflows/flaky-failure-watcher.yml)*