I have been struggling with getting this package compiled because of the need for adding the key to gpg. I am using a docker based clean-chroot build server, so adding the gpg keys permanently to the system not possible (and less reproducible, hence counter productive). May I suggest the following adjustment to the PKGBUILD? It aims to re-implement the gpg-key check in a way that allows for the script to fetch the key from the server before the package is checked:
...
makedepends=('python-build' 'python-installer' 'python-wheel' 'python-setuptools' 'curl' 'wget')
source=("https://github.com/eduvpn/${pkgname}/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.xz")
noextract=("${pkgname}-${pkgver}.tar.xz")
sha256sums=('2074488ebc8021e19c16acf904c5ac134fe00a56929a7c168637357f573af6f9')
prepare() {
curl https://app.eduvpn.org/linux/v4/deb/app+linux@eduvpn.org.asc | gpg --import -
wget "https://github.com/eduvpn/${pkgname}/releases/download/${pkgver}/${pkgname}-${pkgver}.tar.xz.asc"
if ! gpg --verify "${pkgname}-${pkgver}.tar.xz.asc" "${pkgname}-${pkgver}.tar.xz"; then
echo "GPG signature verification failed!"
exit 1
fi
bsdtar -xf "${pkgname}-${pkgver}.tar.xz"
}
build() { ...
This way, the PKGBUILD becomes fully self-contained, while maintaining the gpg-key check on the package. The ...xz.asc is downloaded during the prepare() phase as it otherwise would trigger the gpg-key check before the key is fetched. Bsdtar extracts the package the same way as before, hence, no change is needed in the build() block. Finally, curl and wget have been added to the builddeps, just in case.
Pinned Comments
hv15 commented on 2023-03-07 14:28 (UTC)
Re-added signature, users need to retrieve the PGP public key from upstream: https://app.eduvpn.org/linux/v4/deb/app+linux@eduvpn.org.asc.
For convenience, you can also do the following (note the dash - at the end of the line!):