BTCPay server 2.0.6 update fails on webflow signature

[kravens]

Describe the bug
When debugging the update to latest BTCPay 2.0.6 I encountered an issue in the webflow PGP verification.

To Reproduce
Modify bonus.btcpayserver.sh to install v2.0.6
Run: ~/config.scripts/bonus.btcpayserver.sh install

Debug file

Time Elapsed 00:03:09.70

Install BTCPayServer

Download the BTCPayServer source code v2.0.6

HEAD is now at ba8feeddd Update translations

verify signature of web-flow

--2025-02-06 20:35:48-- https://github.com/web-flow.gpg
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2483 (2.4K) [text/plain]
Saving to: ‘/var/cache/raspiblitz/pgp_keys_web-flow.asc’

/var/cache/raspiblitz/pgp_key 100%[=================================================>] 2.42K --.-KB/s in 0s

2025-02-06 20:35:48 (66.3 MB/s) - ‘/var/cache/raspiblitz/pgp_keys_web-flow.asc’ saved [2483/2483]

importing key of web-flow

pub rsa2048 2017-08-16 [SC] [expired: 2024-01-16]
5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23
uid GitHub (web-flow commit signing) [email protected]

pub rsa4096 2024-01-16 [SC]
968479A1AFF927E37D1A566BB5690EEEBB952194
uid GitHub [email protected]

gpg: key 4AEE18F83AFDEB23: public key "GitHub (web-flow commit signing) [email protected]" imported
gpg: key B5690EEEBB952194: public key "GitHub [email protected]" imported
gpg: Total number processed: 2
gpg: imported: 2

running: git verify-commit ba8feeddd

gpg: Signature made Tue 21 Jan 2025 03:11:48 PM GMT
gpg: using RSA key AB4CFA9895ACA0DBE27F6B346618763EF09186FE
gpg: Good signature from "Nicolas Dorier [email protected]" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: AB4C FA98 95AC A0DB E27F 6B34 6618 763E F091 86FE

goodSignature(1)

correctKey(0)

BUILD FAILED --> PGP verification not OK / signature(1) verify(0)

[kravens]

Fixed it by commenting the webflow and uncommenting nicolasdorier PGP key:

check who signed the release (person that published release)

PGPsigner="nicolasdorier"
PGPpubkeyLink="https://keybase.io/nicolasdorier/pgp_keys.asc"
PGPpubkeyFingerprint="AB4CFA9895ACA0DBE27F6B346618763EF09186FE"

---

#PGPsigner="Kukks"
#PGPpubkeyLink="https://github.com/${PGPsigner}.gpg"
#PGPpubkeyFingerprint="8E5530D9D1C93097"

---

#PGPsigner="web-flow"
#PGPpubkeyLink="https://github.com/web-flow.gpg"
#PGPpubkeyFingerprint="B5690EEEBB952194"