[Mahajan-Sachin]

Document the GPG environment variable in the usage synopsis and environment variables list of asmap-verify so users know the GPG binary path can be overridden.

[hodlinator]

One could argue that keys should be trusted by everyone once committed to the main branch, but I'm not sure we want to add automatic importing. Feels safer to keep it a conscious action performed by the user. Keeping it that way might also catch invalid keys that the user expected to work.

Curious to hear what other people think.

---

Thanks for adding GPG to the help text!

[Mahajan-Sachin]

Thanks for the review and the thoughtful point, @hodlinator!

That makes total sense from a security and key-management perspective — avoiding implicit modifications to the user's local GPG keyring is a very valid concern.

If we prefer not to auto-import by default, here are two alternative approaches we could take:

1. Helpful hint on failure: If verification fails because the public key isn't found in the keyring, check if builder-keys/<signer>.gpg exists and print a clear suggestion to the user (e.g., Key not found in keyring. You can import it with: gpg --import builder-keys/<signer>.gpg).
2. Opt-in flag: Only auto-import if an explicit flag or environment variable is passed (e.g., --import-keys or AUTO_IMPORT_KEYS=1).

Happy to update the PR based on what you and others think is the cleanest approach!

[hodlinator]

1. Helpful hint on failure: If verification fails because the public key isn't found in the keyring, check if builder-keys/<signer>.gpg exists and print a clear suggestion to the user (e.g., Key not found in keyring. You can import it with: gpg --import builder-keys/<signer>.gpg).

Isn't this what we do on the main branch already?

[Mahajan-Sachin]

Ah, you're completely right! I double-checked main and see that the hint is indeed already in place.

Since keeping key imports explicit is preferred and the hint is already handling the UX, I'm happy to simplify this PR to just document the GPG environment variable in the usage synopsis so users know it can be overridden.

Let me know if you'd like me to update the branch accordingly!

[hodlinator]

Since keeping key imports explicit is preferred and the hint is already handling the UX, I'm happy to simplify this PR to just document the GPG environment variable in the usage synopsis so users know it can be overridden.

Sounds good to me. 👍

[Mahajan-Sachin]

@hodlinator Updated! The PR has been simplified to solely document the GPG environment variable in the usage synopsis.

[hodlinator]

ACK b12896e

[hodlinator]

Please update the PR description to match the current state.

[Mahajan-Sachin]

@hodlinator Done! Updated the PR description. Thanks for the review and ACK!