GlcoinCore/specter-desktop
1
0
Fork 0
mirror of https://github.com/cryptoadvance/specter-desktop.git synced 2026-08-13 12:33:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

ci: harden elements GPG key import in install_noded.sh (#2621)

Browse source 
Co-authored-by: Nazim <nazim@openclaw.ai>
This commit is contained in:
al-munazzim 2026-05-11 21:22:50 +02:00 • committed by GitHub
parent 9e43afbdd0
commit 64139ebdb7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/install_noded.sh
View file

@ -317,14 +317,18 @@ function gpg_verify_sums {
fi
local imported=0
for fpr in "${keys[@]}"; do
# Try keys.openpgp.org first, then keyserver.ubuntu.com.
if curl -fsSL "https://keys.openpgp.org/vks/v1/by-fingerprint/${fpr}" 2>/dev/null \
| gpg --import 2>/dev/null; then
imported=$((imported + 1))
continue
fi
if curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${fpr}&options=mr" 2>/dev/null \
| gpg --import 2>/dev/null; then
# Import from both sources. Some keyservers may return partial key
# material for old signatures (e.g. missing signing subkeys).
# Importing from both increases robustness while keeping the same
# pinned trust anchors for verification.
curl -fsSL "https://keys.openpgp.org/vks/v1/by-fingerprint/${fpr}" 2>/dev/null \
| gpg --import 2>/dev/null || true
curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${fpr}&options=mr" 2>/dev/null \
| gpg --import 2>/dev/null || true
# Count this key as imported if it exists in the keyring after the
# multi-source import attempts.
if gpg --list-keys --with-colons "$fpr" 2>/dev/null | grep -q '^pub:'; then
imported=$((imported + 1))
fi
done