verify commits failed #22737

<!-- This issue tracker is only for technical issues related to Bitcoin Core. General bitcoin questions and/or support requests are best directed to the Bitcoin StackExchange at https://bitcoin.stackexchange.com. For reporting security issues, please read instructions at https://bitcoincore.org/en/contact/. If the node is "stuck" during sync or giving "block checksum mismatch" errors, please ensure your hardware is stable by running memtest and observe CPU temperature with a load-test tool such as linpack before creating an issue! -->

<!-- Describe the issue -->

Expected behavior PASS Verified

<!--- What behavior did you expect? -->

Actual behavior Failed. Some console printed as followed: No parent of 803ef70fd9f65ef800567ff9456fac525bc3e3c2 was signed with a trusted key! Parents are: (NOTHING)

<!--- What was the actual behavior (provide screenshots if the issue is GUI-related)? -->

To reproduce step 1: cd path/to/bitcoin

step 2: gpg --keyserver hkps://keys.openpgp.org --recv-keys $(<contrib/verify-commits/trusted-keys) console log is : gpg: key 410108112E7EA81F: no user ID gpg: key 944D35F9AC3DB76A: "Michael Ford (bitcoin-otc) fanquake@gmail.com" not changed gpg: key D300116E1C875A3D: "MeshCollider dobsonsa68@gmail.com" not changed gpg: key 3648A882F4316B9B: "Marco Falke marco.falke@tum.de" not changed gpg: key 29D4BCB6416F53EC: "Jonas Schnelli dev@jonasschnelli.ch" not changed gpg: key 860FEB804E669320: "Pieter Wuille pieter@wuille.net" not changed gpg: key 74810B012346C9A6: "Wladimir J. van der Laan laanwj@visucore.com" not changed gpg: Total number processed: 7 gpg: unchanged: 6

step 3: git fetch origin && ./contrib/verify-commits/verify-commits.py origin/master && git checkout origin/master

<!--- How reliably can you reproduce the issue, what are the steps to do so? -->

System information

<!-- What version of Bitcoin Core are you using, where did you get it (website, self-compiled, etc)? -->

HEAD commit id: bb9f76a71 OS: MacOS Big Sur Python: Python 3.6.6 (v3.6.6:4cf1f54eb7, Jun 26 2018, 19:50:54) [GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.57)] on darwin

<!-- What type of machine are you observing the error on (OS/CPU and disk type)? -->

<!-- GUI-related issue? What is your operating system and its version? If Linux, what is your desktop environment and graphical shell? -->

<!-- Any extra information that might be useful in the debugging process. -->

<!--- This is normally the contents of a `debug.log` or `config.log` file. Raw text or a link to a pastebin type site are preferred. -->

It looks like there's an issue with the GPG key of @hebasto on keys.openpgp.org. He probably needs to verify his email address (if that's even possible with @users.noreply.github.com addresses) to get his user ID included (see https://keys.openpgp.org/about). When you try to fetch it, it'll be skipped, because it doesn't contain a user ID

gpg --keyserver hkps://keys.openpgp.org --recv-keys 410108112E7EA81F
gpg: key 410108112E7EA81F: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

Downloading the same key from e.g. Ubuntu Key Servers works fine and will cause the verification from above to succeed:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 410108112E7EA81F
gpg: key 410108112E7EA81F: public key "Hennadii Stepanov (GitHub key) <32963518+hebasto@users.noreply.github.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

It looks like there's an issue with the GPG key of @hebasto on keys.openpgp.org.

Fixed:

thanks for @hebasto great work, It has taken effect。

However，same error occurs at 04e01606e31b506837c8eee15acfeb3b8e23e904 verify.

console printed: No parent of 04e01606e31b506837c8eee15acfeb3b8e23e904 was signed with a trusted key! Parents are:

It looks like key.openpgp.org does not contain the current keys of @jonasschnelli. Maybe he can upload his latest one there too :) If you fetch it from there (gpg --keyserver hkps://keys.openpgp.org --recv-keys 29D4BCB6416F53EC), you currently get the one expired at 20.05.2020 and e.g. the Ubuntu Keyserver contains the more recent one expiring at 27.02.2027. Run gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 29D4BCB6416F53EC and try again.

While checking the other commits, I noticed that that there are 141 commits that are signed with the now-expired key of @sipa. I've opened #22768 to add them to allow-revsig-commits.

@n-thumann I have followed your suggestion Running gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 29D4BCB6416F53EC; It works;

however, I met a new one: No parent of db88db47278d2e7208c50d16ab10cb355067d071 was signed with a trusted key!

however, I met a new one: No parent of db88db47278d2e7208c50d16ab10cb355067d071 was signed with a trusted key!

I already expected this and opened #22768 to fix this. Feel free to checkout that branch and test again :)