How to verify the released 2.5.0 pkgx binaries gpg: Can't check signature: No public key

[muravjov]

I want to verify the released binary and cannot find the public issuer key for 764B261F40C595C97C91DB5E4BB69F95BC9CD737 ?

$ gpg --verify pkgx-2.5.0+darwin+aarch64.tar.xz.asc pkgx-2.5.0+darwin+aarch64.tar.xz
gpg: Signature made Tue Mar 25 00:11:22 2025 MSK
gpg:                using RSA key 764B261F40C595C97C91DB5E4BB69F95BC9CD737
gpg: Can't check signature: No public key

$ gpg --keyserver hkp://keyserver.ubuntu.com --recv-key 764B261F40C595C97C91DB5E4BB69F95BC9CD737
gpg: keyserver receive failed: No data

Googling 764B261F40C595C97C91DB5E4BB69F95BC9CD737 also finds nothing.

[mxcl]

@jhheider where do we host the GPG public key?

[jhheider]

We don't, but we definitely should.

https://dist.tea.xyz/tea-pub.key . We could also post it to public keyservers, store it in one or more repos (for tracking), or post or link it from the website.

[mxcl]

Added an FAQ (and added a copy of the key with a better filename):

https://docs.pkgx.sh/appendix/faq#where-is-the-pkgx-gpg-public-key

[muravjov]

ty!