apt-get update: How to check for GPG errors when using scripts?

Question

When running.

sudo apt-get update

For example something like this could happen.

W: GPG error: http://deb.torproject.org wheezy Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681

(This question is not about this particular example warning. It has already been reported.)

Exit code.

echo $?
0

Exit code 0 is problematic for automated use in scripts, where success is expected.

This is a bug in Debian's apt-get:
apt: Provide meaningful exit codes for gpg failures

How to notice GPG errors in scripts when the exit code is not reliable?

Answer 1

Make a wrapper script around /usr/bin/gpgv. Supply the pathname to the wrapper script as the value of Dir::Bin::gpg (using apt-get --option). Have the wrapper script examine the output and exit status of gpgv, and communicate failure back to the toplevel script somehow (I suggest using kill to send a signal).