Replace sks-keyservers.net about docker-jetty HOT 9 CLOSED

I can ask the jetty committers to publish their keys to there, got any documentation we can follow?

from docker-jetty.

The easiest method IMO is https://keys.openpgp.org/about/usage#gnupg-upload

gpg --export [email protected] | curl -T - https://keys.openpgp.org

from docker-jetty.

@tianon thanks!

from docker-jetty.

I've loaded my key into keys.openpgp.org, but I'm also inclined to import them directly to make the build independent of a keyserver... but will follow the examples of other projects. @md5 your thoughts?

from docker-jetty.

Making the build independent of a keyserver does seem desirable, given how much effort goes into making key fetching more reliable. Given that the key IDs are enumerated anyways, it's not like keeping the keys themselves out of the build gains any flexibility.

from docker-jetty.

a solution I have in mind to share the keys and avoid too many copies is to have an image containing the keys (maybe called jetty:keys) such so we can do something as

COPY --from=jetty:keys /keys/* /tmp/
using gpg --import to import the keys
then gpg --batch --verify

from docker-jetty.

There are some relevant notes in https://github.com/docker-library/faq#openpgp--gnupg-keys-and-verification too.

from docker-jetty.

The fix with pr #114 is to use the image https://github.com/jetty-project/jetty-keys which contains a KEYS file with all the keys so we do not download everything again and again

from docker-jetty.

docker-library/official-images#7134

from docker-jetty.