Not possible verify the Linux image GPG signature

[gugol2]

Bug Report

Description

It is not possible to verify the linux status image with GPG.

Steps to reproduce

Follow the instructions:

1. curl -s 'https:///status.app/gpg/release.asc' | gpg --import

Expected behavior

Download and import the Status release public key.

Actual behavior

gpg: [don't know]: invalid packet (ctb=3c)
gpg: read_block: read error: Invalid packet
gpg: import from '[stdin]' failed: Invalid keyring
gpg: Total number processed: 0

Additional Information

• Status desktop version: StatusIm-Desktop-v2.31.1-a322b9-x86_64.AppImage
• Operating System: Ubuntu 22.04.5 LTS

[gugol2]

By the way my gpg version is:

gpg --version
gpg (GnuPG) 2.2.27
libgcrypt 1.9.4

I have also tried in and sandbox with Ubuntu 24.04 and gpg 2.4.4 and I got the same result.

[caybro]

https://status.app/gpg/release.asc gives a 404

Can we fix that pls @felicio @jakubgs ?

[jakubgs]

Where are these instructions at that you followed?

Since we switched the website from status.im to status.app the old content was simply not copied and there is nothing at: https://status.app/gpg/release.asc

So the GPG error is a red herring, there's simply no public key file there.

[jkbktl]

Where are these instructions at that you followed?

It's in docs, seems like someone changed links and never tried it.

Also there's too many slashes after https:

[jakubgs]

Right, a classic case of mindless search and replace.

[jkbktl]

It's fixed and can be closed, I have no permission. Thanks @jakubgs for coop.