Missing GPG pubkey of @Kvaciral #25022

The SHA256SUMS.asc file for the 23.0 release contains signatures from 6 new keys compared to 22.0. One of these is C388F6961FB972A95678E327F62711DBDCA8AE56 from @Kvaciral

$ gpg --verify SHA256SUMS.asc SHA256SUMS
...
gpg: Signature made Sat Apr 23 12:39:56 2022 UTC
gpg:                using ECDSA key C388F6961FB972A95678E327F62711DBDCA8AE56
gpg:                issuer "kvaciral@protonmail.com"
gpg: Can't check signature: No public key
...
$ echo $?
2

This key is present in keys.openpgp.org but the user ID is stripped and the import fails. I haven't been able to locate the key in other keyservers.

$ gpg --keyserver hkps://keys.openpgp.org --search-keys C388F6961FB972A95678E327F62711DBDCA8AE56
gpg: data source: https://keys.openpgp.org:443
(1)	  ECDSA key F62711DBDCA8AE56, created: 2021-03-18
Keys 1-1 of 1 for "C388F6961FB972A95678E327F62711DBDCA8AE56".  Enter number(s), N)ext, or Q)uit > 1
gpg: key F62711DBDCA8AE56: no user ID
gpg: Total number processed: 1
$ echo $?
2
$ gpg -k
$

@Kvaciral maybe you should consider making your full pubkey more easy to obtain, or look into how to make the user ID public on keys.openpgp.org so that your key can be imported and a simple gpg --verify SHA256SUMS.asc SHA256SUMS runs fine. Also your key ID is missing in the builder-keys.txt file.

I have the same issue. @1ma Have you been able to get correct key and verify the signed file somehow?

Nope, not yet.

As of yet I can't unstrip my ID-info on keys.openpgp.org nor add it to my github-profile, so I've put my pubkey into a repo: kvaciral's PGP-pubkey .. I'll open a PR to add my fingerprint to /contrib/builder-keys/keys.txt later when I've signed the next release.

Thanks @kvaciral ! I think it's resolved with that, closing.