Error verifying signature: Invalid GPG signature: (*packet.Signature)( "nil)" about skopeo HOT 5 OPEN

Thanks for reaching out.

That failure doesn’t look like something that should be significantly affected by the build environment; it’s a direct outcome of parsing that signature, with golang.org/x/crypto/openpgp implementation that did change between those versions, but only very slightly.

My first guess, absurd as it may seem, is be that, in fact, the two reproducers are not reading the same signature-1. Failing that, really a small behavior difference between the two golang.org/x/crypto/openpgp implementations, or perhaps in how they are compiled.

from skopeo.

Its the same signature, it's pulled from a repo location.
I agree, it smells like a parsing error. The signature was signed via skopeo v 1.12 but verifies fine with the ubuntu skopeo 1.5.0 oddly.

The wrench in the works maybe grs-grp package from gara-sign.
I'll do some more checking.

from skopeo.

A friendly reminder that this issue had no activity for 30 days.

from skopeo.