Flaky CI Failure: release-android publish — Invalid PGP signature rejected by Sonatype

## Flaky CI Failure: release-android publish — Invalid PGP signature rejected by Sonatype **Workflow:** Release **Failed run:** https://github.com/xmtp/libxmtp/actions/runs/30520771417 **Commit:** 36233222f78aea29e6ed3b89b3bf35c2f54f97f5 **Failed jobs:** release-android / publish ### Summary The Android release publish job failed when Sonatype rejected the staged repository because it could not verify the PGP signature on the `.module` metadata file. The signing step itself succeeded (`Task :library:signReleasePublication`), but Sonatype's verification of the resulting `.asc` file failed with a 400 error. This points to a PGP key configuration issue — the key used in CI may be expired, not registered with a keyserver that Sonatype trusts, or the signing credentials may have changed. ### Error Details ``` > Task :closeSonatypeStagingRepository FAILED FAILURE: Build failed with an exception. * What went wrong: Execution failed for task ':closeSonatypeStagingRepository'. > Failed to close staging repository, server at https://ossrh-staging-api.central.sonatype.com/service/local/ responded with status code 400, body: Failed to process request: Deployment reached an unexpected status: Failed pkg:maven/org.xmtp/android@4.12.0-nightly.20260730.3623322?type=aar - Invalid signature for file: android-4.12.0-nightly.20260730.3623322.module.asc - Failed to verify the PGP signature. Please contact support for assistance. BUILD FAILED in 1m 28s ##[error]Process completed with exit code 1. ``` ### Analysis The signing task (`Task :library:signReleasePublication`) ran without error, so the CI signing secrets are present and the Gradle signing plugin produced the `.asc` file. However, Sonatype's OSSRH staging API rejected the signature during the close/promote step. Likely root causes: - **Expired PGP key**: The key used to sign may have expired and Sonatype's keyserver lookup is failing. - **Key not published to keyserver**: Sonatype requires the public key to be published to a trusted keyserver (e.g., `keys.openpgp.org`, `keyserver.ubuntu.com`). If the key was rotated and the new key was not uploaded, verification will fail. - **Corrupted or mismatched signing credentials**: The `SIGNING_KEY` or `SIGNING_PASSWORD` secret may have been updated with mismatched values, producing a valid-looking signature that doesn't correspond to a published public key. This is a **configuration/infrastructure failure** in the release pipeline's signing setup, not a transient external outage. --- *Reported by [Flaky Failure Watcher](https://github.com/xmtp/libxmtp/blob/main/.github/workflows/flaky-failure-watcher.yml)*