Hi geeko packagers,
Please note that we are receiving a new version of gpg (2.1.0) in
Factory probably rather soon...
One thing to note is that the current version of %gpg_verify passes
--gpg2 to the command, which is no longer understood.
There are obviously two ways to fix it:
- Fix %gpg_verify to no longer pass --gpg; surely simple, but I don't
prefer the solution
- Remove the gpg_verify commands from the .spec files;
In fact, usage of gpg_verify has been deprecated in favor of the obs
service source_validator (which runs at each osc ci call or you can call
it using osc service lr source_validator).
As we already have implicit verification of the signatures there, it is
of no use to verify the signature during build again. Which is also the
reason why option one is not that appealing.
Can I please ask the package maintainers to work with us and eliminate
this wherever it is still used in Factory?
Thanks a lot!
--
Dimstar / Dominique Leuenberger