I am trying to verify the file
using the signature provided here:
I am using the following command:
gpg --verify dropbox-lnx.x86_64-108.4.453.tar.gz.asc
which results in the following output:
gpg: assuming signed data in 'dropbox-lnx.x86_64-108.4.453.tar.gz' gpg: Signature made Tue 20 Oct 2020 10:53:17 PM CEST gpg: using RSA key FC918B335044912E gpg: Can't check signature: No public key
My GPG-configuration in
~/.gnupg/gpg.conf looks like this:
keyserver keyserver.ubuntu.com auto-key-retrieve
with emphasis on the
auto-key-retrieve. This setup works, as in: I successfully verified files with it before, even if I didn't have the public key in question; it was retrieved as expected during verification.
gpg --search-keys FC918B335044912E also shows that the key can be found on the keyserver I'm using. I can also
gpg --recv-keys it, after which the verification obviously works.
My question, which might stem from a misunderstanding of the operations of
gpg is: Why can I manually get the key in question, but not automatically using
auto-key-retrieve, even though I know it works with other keys?