1. I’m using Kotest in another project, and I’m ve...

# kotest

[jaguililla]

2. I’m using Kotest in another project, and I’m verifying dependencies there, where may I find the public PGP key to validate Kotest’s dependencies integrity?

[sam]

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBF7ByYMBEADHxAxXj4u914xQb5fJ+sBvk0rKpqOZPFMIiuyNMD72Dk2jZbvW
ESuRlzp9MObyylGTsxeX+f+Fq+piqqgAAFWyXx+JNV4UkDLSt8g6n0phW97Wj89b
ybWFDUnvgr+IeNZ0pBX2MPRPXrtZhayk8ahY84fps8CFJN/NMi0HExYP9Ttt59/b
njWFDy9NI5/CzgRB9e4sv/mHPNwZOA8fonG3xQ0eBHbnl+Wv7wnnUixbtZt92ZEf
VL4mb0HJyxKVVPZWFH3Sm8oukAxNqxCS0pxOXTWCfvtEFatA5AKgbGFpw4PMoQ2O
QEGm5HgfgyObuGr8imnvtvSUhopmUj858rfoN0PqqsqF8AFtJusfVLeVloBRHhe7
Yjn3uyGgY5pUw4csXY9p9Uf9yjD8r6RyZGyuNPdVy7drTaP3ZMYDA/jaJG3hDtbh
eu2w4eTCIRCYtEr/LzVQVo/HYJDmRwoUI30A/IfrgNIDWjHkrG7uVpynt6dAddSh
JfEWUFsjw4Oi+yHWWxeSjlLc/Uf9vt2GNjjpMXpp8r+VQsKqDbzKWOA9yrpIwhs9
Mu+qBOsBgCy6sPsJpZ7Qqr4gnh5vrBGZaRA5WRjdSlP5yzsYyCYnSCquKMy+Uk8n
54sRGRxcNjDVJVVlZuiFVbbX2f1OEgVNbnp0PMUym+QbJdPI//xjKYU2wQARAQAB
tBtza3NhbXVlbCA8c2FtQHNrc2FtdWVsLmNvbT6JAk4EEwEKADgWIQRcuhnlYUHn
jVS/cW8IpKSVjWH8PQUCXsHJgwIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
CRAIpKSVjWH8PQNcD/9VIUpZmitaH8zdS4qsJ95XE6SrK/IdYQQFexGocSPK2aE7
pI+I2TcFUhzfZApDFp54upDrQb0wyjLLJwh0Iv4hyi2+qsDKQeJylxBo8N2OY8OA
DU0eaaxLtu80VOa8oMDMg+OdCMgU3vzCU1Wv+jmNEwTuHnKEHfP1eIGetdz3vT8e
1cZywJew09ZSrTrggF60O+HjYm5xkqL6+1KSI4G+9RdDszFrQUcFoJMaMFlWVG5n
xdbmibSQfVt67j643oHf6QiPpnpp9tAdfkIOCYDtw8Y2w+O5mt9GQrfC9gbPDxRu
PKSOIvZrBAJI0sj2IUd4Xz+s9xfJQIy6jWQHSX3DToqLQ0pWL5EkDb9kkqfHGbRl
27KiL65Jr+gmlCIew4g1vUdjiRLidZZWKJvAOAecd91m0izZPZGFwjER2BAOtfuc
UD1wWuaZWZl4E7T+E1XBig8IAv01njc1s6T9jZduAT60r6YifB3lhHqroDRy6eV5
sVu4cUJ/wKYUPhY+SsLRl4NBbP5/sidOiqG2NA3M8F84MZ0NKcW3syYQjvcTE7mH
5z6hb4UIwj7YuhBZj23vrzCsVp5W7VlyCop46BYA4415AsEVK4zbchD8ayl2jMJR
5F6VgyPICtSgWuguk2Y+miPB1UI+Oa0pLYVsnYf8MxBE//6EkZKYDzblVo9VSLkC
DQRewcmDARAA1TnaGX6UF6D5n3SNxNg6zzBT1t5b7iMnVaxvGkT5c6Po3HkaFqGm
BWxka3t9KA9qu679wSPpVp/pQv52y7+N5IuDNB8RD5b3gxGADo4yyX+DntPRmP9G
B3zKE04sE5SBUP85WvnqUQb/E9kZfS0m8FdqglWg8PNL+y+JgwRm6t8DvKtprU1n
D+fga0pHYbOXVV6OCmanHlC45XQX/os4EPB9G8IjetXJ65fvx7YXC1gnTOP1Q159
N23J4/6gRbQoYkBi+CtKgB2T24x8F3133WTadHcXil/nNjsVt+PjKnS/jExKCXvf
9ysE8PoCkKY5JvIESirqo9xEMNj0sffJGDkFyhA6vwlWYom74Kg/A595p3M7DNi1
9PMF28/ImQ1of4mwlzyFNh/RYlcLjkLjq1woeQrZXXnO/71O2Ux2ZSuM+diHSzj6
wHwdHKbaIIZg6EJwWjOFvrszetUT4XWsVI3Et9uNGkY4rXH1Bb79VjeC/LCgwr/r
0mCIqR4Uo70RkZQuYTTb4oOOr5ULls/9huU11fXYfwtXqxJXZARyCl0hV69a/k+u
j1vjJ+GrkOa4pVT8e83ORJhDd+I6GGbYxKiqE1I4/4aO3vDxg5SOYAJHzrJDT3zY
8iUEbhYYI7m+RKl8DxAxxjGqJxDvBZ6VJj6DM+9TEmZ42IwnCGKx3tMAEQEAAYkC
NgQYAQoAIBYhBFy6GeVhQeeNVL9xbwikpJWNYfw9BQJewcmDAhsMAAoJEAikpJWN
Yfw9V9sP/iGk+A57hF0LVxaGBzFefse3Yc4gVRtTmUOm5xRF0lapqtZXNSSd+rAz
Mml5B1F+CRyRPQQHyd+DCR3A1uj1g+5Yn+F7NisJNUUNWTxkBch3LtvUDeXU0X7v
Ljtv2nc+p8eDjYRjYZTe2xk6rtToo4F0BF/1CVFdi1UIewyow6tUCkBiTV0eER8x
uGJlxAxdMJaJKmDmwjkT1NE1tZ790XC/2jPj5u/xwHldZgx1PLAA6UMsyx3wPgWN
WVjjygFcDQ2ZweBkeE+Zr4p2emSQMIwdJG6k6z5LbI6oPYb2VITCNfUwBuNMJU1b
eEFekVzXiCvTaOC4qtbnwQS+mvZIZppJg1ManY5NwAV2CJL8mZiDVKdcKUx0buf8
u5gfeypcqI3b/r/ZRRVBebMXff1yoqNcIRW0GrpbIgMJ4j53inj3+bdcRoNgaPZD
yUgLH8HK496/ew0/VPuMnLREnFlzr86mSC5NusIqsKmoh6hJ9zv8cNQ2eNQyPsIj
9NA/QbSBw0kKe5Yt/Bu8z7Jus2tQeCdaTtrRLAFgtK7cjviA8wQn7i3XYSHu+XIx
nuLkTz6tw2RHgWr/xczpi9EdyeijE5Z93dsOMUFvpHkmk48U+3a0EG+pOXFAVPPn
15CYK7vUQFiD9rhMoRKWbti0Tcq0k/T8g5W7Mrba0+MF16gj0Wm1
=y6ga
-----END PGP PUBLIC KEY BLOCK-----

[LeoColman]

What happens when I deploy, Sam? I think we don't sign it with your pgp key, right?

[sam]

The deployment is through github now, you just need to push a commit called vX.Y.Z

[sam]

and github actions does the rest

[LeoColman]

nice

[jaguililla]

Is that key published in any PGP public key server?

[sam]

yes

[jaguililla]

I cannot find it in any key server, is it registered with some email so I can search?

[sam]

[e-mail]

[jaguililla]

Thanks, I just found it

[jaguililla]

I got these errors when Gradle verifies dependencies

[jaguililla]

It seems the signing key doesn’t match the published one here: http://keys.gnupg.net/pks/lookup?search=sam%40sksamuel.com&fingerprint=on&op=index

[sam]

I can't view the key in github as it's hidden once created

[jaguililla]

I went back to the 4.0.5 which is the last working for me, verified with the key that has this fingerprint: 7184ba44a830800058f1c05fc7bbed0b8f878af8

[sam]

But it's going to be one of the ones from my pc

[sam]

the keys in that search look old

[jaguililla]

It would be great if the verification info is shown in the readme… I know there is not a lot of people that checks dependencies, but still, it would be worthy information

[sam]

agreed

[jaguililla]

I will use 4.0.5 until next release

[jaguililla]

Thanks!

[sam]

https://keyserver.ubuntu.com/pks/lookup?search=sksamuel&fingerprint=on&op=index

[sam]

https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x5cba19e56141e78d54bf716f08a4a4958d61fc3d

[sam]

That's the one I think

[sam]

I've resubmitted it to gnupg.net too but it might take hours or days to appear in the search.

[jaguililla]

Still no luck, I will try tomorrow to see if it got updated. Thanks again!