update readme to fix instructions for gpg

[antonmos]

Something changed in recent version of the libraries within openjdk:8-jdk-slim docker image and now the existing steps were failing with erro gpg: cannot open '/dev/tty': No such device or address.

[tianon]

See the discussion over in https://bugs.debian.org/913614: TLDR is that this should be --batch, not --no-tty.

[krallin]

Thanks @antonmos for reporting the issue, and thanks @tianon for suggesting --batch!

@antonmos: I updated your PR to use --batch accordingly

[antonmos]

I just tried it with --batch and it failed:

gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
key 9A84159D7001A4E5:
1 signature not checked due to a missing key
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 9A84159D7001A4E5: public key "Thomas Orozco <thomas@orozco.fr>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no signed data
gpg: can't hash datafile: No data
The command '/bin/sh -c apt-get update  && apt-get install gnupg -y  && gpg --batch --keyserver hkp://ipv4.pool.sks-keyservers.net --recv-keys 595E85A6B1B4779EA4DAAEC70B588DFF0527A9B7  && gpg --batch --verify /tini.asc' returned a non-zero code: 2

Per the last message in the debian bug it seems that --no-tty is the recommended solution

[yosifkit]

@antonmos, it look like you forgot to download tini, since the error is: gpg: can't hash datafile: No data

[antonmos]

My Dockefile is unchanged other than changing from --batch to --no-tty. Please see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913614#40 for more info.

[yosifkit]

It looks like the problem is that /tini needs to be added to the verify line now that it is in batch mode. Plus it is a good idea to always do so. From the man page:

Note: If the option --batch is not used, gpg may assume that a single
argument is a file with a detached signature, and it will try to find a
matching data file by stripping certain suffixes. Using this historical
feature to verify a detached signature is strongly discouraged; you
should always specify the data file explicitly.

[antonmos]

For the life of me, i cant find where the man page explains how to "specify the data file explicitly". @yosifkit any idea?

[antonmos]

For the life of me, i cant find where the man page explains how to "specify the data file explicitly". @yosifkit any idea?

Never mind, figured it out. Updating the new PR.