I am trying to automate the compilation of the newest GCC on my dev machine, and I'd like to automatically verify the signature of the tarball too. However, I can't get
gpg --auto-key-retrieve to work:
gcc# gpg --auto-key-retrieve --verify gcc-11.1.0.tar.xz.sig tarballs/gcc-11.1.0.tar.xz gpg: Signature made Tue Apr 27 12:39:44 2021 CEST gpg: using RSA key 6C35B99309B5FA62 gpg: Can't check signature: No public key
If I manually retrieve the key, it works just fine (and the
gpg --verify succeeds as well):
gcc# gpg --recv-keys 6C35B99309B5FA62 gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key 6C35B99309B5FA62: public key "..." imported gpg: Total number processed: 1 gpg: imported: 1
(default keyserver used in the above is
- manually specifying the server,
- auto-key-locate (though I've learned this has nothing to do with my use case).
What am I doing wrong?
I'm running gpg version 2.2.19 on Ubuntu 20.04.2 and working on files originally from http://ftp.gnu.org/gnu/gcc/gcc-11.1.0/.