docs(gpg-verification): gpgv is a separate package on debian#40
Conversation
gnupg does not pull in gpgv on debian/ubuntu; a job verifying with gpgv must install it explicitly or every call fails with a silent 'command not found'. Alpine's gnupg bundles it. Host-testing hides the gap. From NRS-4496 (a scheduled check-version-signers job failed only in the debian CI image). Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the GPG verification documentation to clarify that gpgv is not always bundled with the gnupg package, highlighting the differences between Debian/Ubuntu and Alpine environments. The review feedback suggests replacing a Unicode ellipsis (…) with standard ASCII three dots (...) in an inline code snippet to prevent potential copy-paste issues.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Remove the NRS-* Jira key and git.netresearch.de hostname - this repo is public. Keep the generic technical content. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
… snippet Addresses review: avoid non-ASCII in a copy-pasteable code fragment. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
|
1 participant
Two changes to the gpg-verification reference (public repo hygiene + a new gotcha):
gpgvcomes withgnupgeverywhere. On debian/ubuntugpgvis a separate package —apt-get install gnupgdoes not provide it, and a gpgv-based verify then fails with a silentcommand not found. Alpine's gnupg bundles it. Host-testing hides the gap.