/ /

Hibernate ORM Extension

Docs Home

Client Libraries

Java

Hibernate ORM Extension

Docs Home

Client Libraries

Java

Hibernate ORM Extension

Validate Hibernate Extension Artifact Signatures

Overview

You can validate the signature of a MongoDB Extension for Hibernate ORM artifact that MongoDB publishes to Maven Central. Validating an artifact signature helps you confirm that the artifact is authentic and unmodified.

Procedure

These steps describe how you can validate Hibernate ORM extension artifact signatures.

Install encryption software

You must install the GnuPG encryption suite to validate artifact signatures from the command line.

On macOS, you can install GnuPG by using Homebrew:

brew install gnupg

Tip

You can also install GPG Suite, which provides a graphical interface for GnuPG. There is a Homebrew installation for GPG Suite.

Download and import the MongoDB signing key

Download and import the public key that MongoDB uses to sign the release:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

You can also find release-specific instructions on the MongoDB Extension for Hibernate ORM releases page.

Download the signed artifact

Download the MongoDB Extension for Hibernate ORM artifact that you want to verify from Maven Central.

The following example downloads version 1.0.0 of the extension:

curl -LO https://repo.maven.apache.org/maven2/org/mongodb/mongodb-hibernate/1.0.0/mongodb-hibernate-1.0.0.jar

To verify a different version, replace 1.0.0 in the command with the version that you want to verify.

Download the artifact signature

Download the detached signature file for the same artifact and version:

curl -LO https://repo.maven.apache.org/maven2/org/mongodb/mongodb-hibernate/1.0.0/mongodb-hibernate-1.0.0.jar.asc

The .asc file must correspond to the artifact file that you downloaded.

Verify the signature

Run the following command from the directory containing the artifact and its signature:

gpg --verify mongodb-hibernate-1.0.0.jar.asc mongodb-hibernate-1.0.0.jar

If the signature is valid, GnuPG prints a message similar to the following:

gpg: Signature made Wed Sep 16 19:15:35 2026 IST
gpg:                using RSA key 76E0008D166740A8
gpg: Good signature from "MongoDB Java Driver Release Signing Key <packaging@mongodb.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 1A75 005E 1421 9222 3D6A 7C3B 76E0 008D 1667 40A8

A valid signature confirms that the artifact matches the signed release. Review the key fingerprint and signing identity before trusting the result.

Additional Information

To learn more about verifying signatures, see Verify Integrity of MongoDB Packages in the Server manual.

Back

Transactions & Sessions

Feature Compatibility