GH Scallywag CI fails - No public key?

[Jon Turney]

On 20/09/2026 12:58, Brian Inglis via Cygwin-apps wrote:
> Hi folks,
> 
> Not clear why job is failing, unless public key required (hkp:// 
> pgpkeys.eu - can we add or prefix this - keyservers seem to be going 
> hkp: rather than hkps: which no longer always seems to work)?

Hmm.. yeah, this is non-obvious.

I think maybe this is failing because the exit status of the last 
command src_unpack_hook() ran is non-zero.

So maybe it just needs a 'return 0' at the end?

(This needs to be more clearly documented and/or reported, though!)

> The package includes a python download/install script to retrieve and 
> install source test data, so rather than run at build time, in the 
> unpack hook, extract the URI and file info from the script JSON params, 
> fetch (from the GH pillow repo), unpack, and install the source test 
> data (name with spaces) to tests/data directory (under a different name 
> without spaces).

I'm curious why spaces are a problem here?

> 
> Another issue is the tests require using meson, which seems to mess up 
> our packaging, and support for which is described in the package as 
> experimental.

Doing 'inherit meson' after you've defined src_compile and src_install 
is going to redefine them to the default meson version of those.

This is why putting inherits at the top of the file is the norm.
> 
> https://cygwin.com/cgit/cygwin-packages/freetype2/commit/?h=playground
> 
> https://github.com/cygwin/scallywag/actions/runs/35507452467/ 
> job/106069562277
> 
>  >>> Preparing freetype2-2.14.3-1.x86_64
> *** Info: SOURCE 1 signature follows:
> gpg: directory '/home/runneradmin/.gnupg' created
> gpg: Signature made Sun, Mar 22, 2026  3:20:00 PM UTC
> gpg:                using RSA key E30674707856409FF1948010BE6C3AAC63AD8E3F
> gpg: sending fd 7 to keyboxd: Not implemented <GnuPG>
> gpg: Can't check signature: No public key
> *** Info: SOURCE 2 signature follows:
> gpg: Signature made Sun, Mar 22, 2026  3:20:01 PM UTC
> gpg:                using RSA key E30674707856409FF1948010BE6C3AAC63AD8E3F
> gpg: sending fd 7 to keyboxd: Not implemented <GnuPG>
> gpg: Can't check signature: No public key
> *** Info: SOURCE 3 signature follows:
> gpg: Signature made Sun, Mar 22, 2026  3:20:00 PM UTC
> gpg:                using RSA key E30674707856409FF1948010BE6C3AAC63AD8E3F
> gpg: sending fd 7 to keyboxd: Not implemented <GnuPG>
> gpg: Can't check signature: No public key

I'm kind of perplexed by this.

If .sig files are listed in the SRC_URI and gpg is available, they will 
by checked.

But I don't see any sign that our gnupg package is installed, so I'm not 
sure what's going on there.

Probably the answer to your original question about what to do about the 
public key is to define some mechanism for cygport to read it from 
somwhere... but I'm not sure if that should be in the package repository 
or in a bundle that cygport installs?

(and we ought to make the use of signatures mandatory for supply-chain 
security reasons, but SHTDI...)