How do I verify a downloaded emacs source tar.gz file?

Question

I downloaded https://ftp.gnu.org/gnu/emacs/emacs-27.2.tar.gz[.sig] and tried verifying using the following command

gpg --keyserver-options auto-key-retrieve --verify emacs-27.2.tar.gz.sig

It failed with the following output:

gpg: Signature made Thu 25 Mar 2021 06:53:10 AM CDT using RSA key ID 01EB8D39 gpg: requesting key 01EB8D39 from hkp server keys.gnupg.net gpgkeys: HTTP fetch error 6: Could not resolve host: keys.gnupg.net; Unknown error gpg: no valid OpenPGP data found. gpg: Total number processed: 0 gpg: Can't check signature: No public key

score 2 · Answer 1 · answered Oct 19 '21 at 02:32

I've never had luck with the auto-key-* options. Try using two steps.

$ ls -la emacs-27*
.rw-r--r--@ 67M nega 18 Oct 22:13 emacs-27.2.tar.gz
.rw-r--r--@ 473 nega 18 Oct 22:13 emacs-27.2.tar.gz.sig

$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-key 91C1262F01EB8D39
gpg: key 91C1262F01EB8D39: public key "Eli Zaretskii (eliz) <eliz@gnu.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --verify emacs-27.2.tar.gz.sig
gpg: assuming signed data in 'emacs-27.2.tar.gz'
gpg: Signature made Thu Mar 25 07:53:10 2021 EDT
gpg:                using RSA key 91C1262F01EB8D39
gpg: Good signature from "Eli Zaretskii (eliz) <eliz@gnu.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E6C9 029C 363A D41D 787A  8EBB 91C1 262F 01EB 8D39

Note that as of at least gpg 2.3.1 --keyserver-options auto-key-retrieve is deprecated in favor of --auto-key-retrieve (which also didn't work for me).

I accepted @phils answer as it shows the root cause. I will up your answer. — AnilJ, May 17 '22 at 23:49

score 2 · Accepted Answer · answered Nov 18 '21 at 06:19

gpg: requesting key 01EB8D39 from hkp server keys.gnupg.net gpgkeys: HTTP fetch error 6: Could not resolve host: keys.gnupg.net

SKS keyservers such as keys.gnupg.net are no longer a thing (due to an attack on the keyserver network), and consequently programs/procedures which expected them to exist may now fail on that account.

Some references are:

How do I verify a downloaded emacs source tar.gz file?

2 Answers2