From 01890a7d399b2fd43a6d723a88494b7a81930654 Mon Sep 17 00:00:00 2001 From: Build System Date: Tue, 7 Jul 2026 21:33:17 +0200 Subject: [PATCH] ci: add F5 signer key "arut" to nginx PGP verification list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tools/ci-build.sh imports nginx release-signing keys before verifying the source tarball's detached signature. Current nginx releases (1.31.2 tested) are signed by Roman Arutyunyan , RSA key 43387825DDB1BB97EC36BA5D007C8D7C15D87369 — the F5-era signer — whose public key is served at https://nginx.org/keys/arut.key. It was missing from the import loop, so `gpg --verify` found no matching key, verification failed, and ci-build.sh exited before any build. Add "arut" to the loop. Verified: importing arut.key and checking nginx-1.31.2.tar.gz.asc yields "Good signature". The loop tolerates missing keys (|| true), so this is safe as signers rotate. --- tools/ci-build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/ci-build.sh b/tools/ci-build.sh index 6047b0c..db32f93 100644 --- a/tools/ci-build.sh +++ b/tools/ci-build.sh @@ -70,7 +70,7 @@ wget -q "https://nginx.org/download/${tarball}.asc" -O "${tarball}.asc" gnupghome="$(mktemp -d)" export GNUPGHOME="$gnupghome" chmod 700 "$gnupghome" -for key in nginx_signing mdounin maxim sb thresh pluknet; do +for key in nginx_signing mdounin maxim sb thresh pluknet arut; do wget -q "https://nginx.org/keys/${key}.key" -O - 2>/dev/null \ | gpg --quiet --import 2>/dev/null || true done