If you want to verify a signature of a downloaded file with gpg, you first have to import the key. Unfortunately, this operation is extremely slow and flaky in practice.
For example, here I tried it out:
$ gpg --keyserver pgpkeys.mit.edu --recv-key A0E98066 gpg: keyserver receive failed: No data $ gpg --keyserver pgpkeys.mit.edu --recv-key A0E98066 gpg: key B550E09EA0E98066: public key "Yichun Zhang (agentzh) <firstname.lastname@example.org>" imported gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 14 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 14u gpg: next trustdb check due at 2019-01-13 gpg: Total number processed: 1 gpg: imported: 1
The first run failed. When I repeated, it took very long but eventually succeeded. Especially, in a CI environment, it breaks a lot, that is why I am looking for alternatives.
- How do you avoid the dependence to the remote keyserver?
- Is there an easy way to export the key as a file and use it later to import it in the CI environment without making a request to the keyserver?