Verify public key for COPR repositories

I enabled the COPR repository for asus-linux and imported the GPG key. I was hoping there was a way to confirm that the the public key that I imported does indeed belong to the author. I searched COPR website but can’t find anywhere where the authors have their public keys posted. Would I need to reach out to the author of the COPR individually for verification or is there a way to search online or a database? I tried MIT and Ubuntu keyservers and no hits :frowning:

There is a gpgkey= field in the repository file of the copr repo (which is located in /etc/yum.repos.d directory). It looks like:

gpgkey=https://download.copr.fedorainfracloud.org/results/username/repo-name/pubkey.gpg

You can also verify that URL is correct by comparing it with the repo file on the copr website. You can see the repo file by clicking one of the releases shown in the picture below:

1 Like