PHAR signature could not be verified

[jakzal]

Deptrac installation fails due to signature verification failure (btw, keys seem to have been changed again).

To reproduce:

phive --no-progress install deptrac -t deptrac

Phive 0.14.5 - Copyright (C) 2015-2021 by Arne Blankerts, Sebastian Heuer and Contributors
Fetching repository list
Downloading https://github.com/qossmic/deptrac/releases/download/0.15.1/deptrac.phar
Downloading https://github.com/qossmic/deptrac/releases/download/0.15.1/deptrac.phar.asc
Downloading key A98E898BB53EB748
Trying to connect to keys.openpgp.org (37.218.245.50)
Downloading https://keys.openpgp.org/pks/lookup?op=get&options=mr&search=0xA98E898BB53EB748
Successfully downloaded key.

        Fingerprint: EAE1 02AC FB79 3F59 A0C0 1D74 A98E 898B B53E B748

        Denis Brumann <denis.brumann@qossmic.com>

        Created: 2021-01-29

Import this key? [y|N] y
[ERROR]    Signature could not be verified
[ERROR]    General error

[MGatner]

Not sure if this is related, but when I use phive update qossmic/deptrac it only takes me up to version 0.14.1. If I completely remove deptrac and purge the global too then running phive install qossmic/deptrac gives the error above.

New key is A98E898BB53EB748, previously was B8F640134AB1782E.

[dbrumann]

🙈 It's #598 all over again. I have just uploaded the key to https://keys.openpgp.org and keyserver.ubuntu.com, so it should work now.

The key changed because I was using my work account, instead of my private account. I'm absolutely certain that I used the "upload to keyserver" feature in gpg keychain before releasing, which should submit the key to keys.openpgp.org, but it looks like it didn't work.

[jakzal]

The key is available on the server now but unfortunately, the problem persists: Signature could not be verified.

[dbrumann]

I have just re-release 0.15.1 as 0.15.2 with the old signature. Can you check if it works now?

[MGatner]

@dbrumann just kicked off codeigniter4/CodeIgniter4#5021 again, we'll see shortly.

[MGatner]

Passed! Thanks for the quick turnaround, all looks good on our end.

[dbrumann]

Sorry for the troubles. Glad it's working now.

[jakzal]

Works, thanks! 🍺