Hello, On 9/25/18 10:53 PM, Bjoern Voigt wrote:

The macro %gpg_verify is unavailable (tested with Tumbleweed). What is currently the right way to verify GPG signatures of sources?

The functionality of this macro was completely replaced by the verify_source source service which runs automatically during check-in and build. If the package contains a %name.keyring, that keyring will be used to very any .asc/.sign file against matching .tar/.tar.gz etc. without further need to add anything in the spec file.

What is a good example package for GPG verification?

grep. Andreas -- Andreas Stieger Head of Product Security SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-buildservice+owner@opensuse.org

https://en.opensuse.org/openSUSE:Package_source_verification On 25/09/2018 22.53, Bjoern Voigt wrote:

Currently the package "maildrop" from server:mail repository fails to build for many distributions, e.g. for Tumbleweed, Leap 42.3, Leap 15.0 and Factory.

https://build.opensuse.org/package/show/server:mail/maildrop

The error message is "nothing provides gpg-offline".

The maildrop.spec file contains the following GPG related entries:

%if 0%{?suse_version} >= 1230 BuildRequires:  gpg-offline %endif

[...]

%prep %if 0%{?suse_version} >= 1230 %gpg_verify %{SOURCE1} %endif

The macro %gpg_verify is unavailable (tested with Tumbleweed).

What is currently the right way to verify GPG signatures of sources? What is a good example package for GPG verification?

Greetings, Björn