How do I verify a downloaded emacs source tar.gz file?

Question

I downloaded https://ftp.gnu.org/gnu/emacs/emacs-27.2.tar.gz[.sig] and tried verifying using the following command

gpg --keyserver-options auto-key-retrieve --verify emacs-27.2.tar.gz.sig

It failed with the following output:

gpg: Signature made Thu 25 Mar 2021 06:53:10 AM CDT using RSA key ID 01EB8D39 gpg: requesting key 01EB8D39 from hkp server keys.gnupg.net gpgkeys: HTTP fetch error 6: Could not resolve host: keys.gnupg.net; Unknown error gpg: no valid OpenPGP data found. gpg: Total number processed: 0 gpg: Can't check signature: No public key

Answer 1

gpg: requesting key 01EB8D39 from hkp server keys.gnupg.net gpgkeys: HTTP fetch error 6: Could not resolve host: keys.gnupg.net

SKS keyservers such as keys.gnupg.net are no longer a thing (due to an attack on the keyserver network), and consequently programs/procedures which expected them to exist may now fail on that account.

Some references are:

• https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
• https://hub.packtpub.com/an-attack-on-sks-keyserver-network-a-write-only-program-poisons-two-high-profile-openpgp-certificates/
• https://code.firstlook.media/the-death-of-sks-pgp-keyservers-and-how-first-look-media-is-handling-it
• https://unix.stackexchange.com/questions/656205/sks-keyservers-gone-what-to-use-instead

Answer 2

I've never had luck with the auto-key-* options. Try using two steps.

$ ls -la emacs-27*
.rw-r--r--@ 67M nega 18 Oct 22:13 emacs-27.2.tar.gz
.rw-r--r--@ 473 nega 18 Oct 22:13 emacs-27.2.tar.gz.sig

$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-key 91C1262F01EB8D39
gpg: key 91C1262F01EB8D39: public key "Eli Zaretskii (eliz) <eliz@gnu.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --verify emacs-27.2.tar.gz.sig
gpg: assuming signed data in 'emacs-27.2.tar.gz'
gpg: Signature made Thu Mar 25 07:53:10 2021 EDT
gpg:                using RSA key 91C1262F01EB8D39
gpg: Good signature from "Eli Zaretskii (eliz) <eliz@gnu.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E6C9 029C 363A D41D 787A  8EBB 91C1 262F 01EB 8D39

Note that as of at least gpg 2.3.1 --keyserver-options auto-key-retrieve is deprecated in favor of --auto-key-retrieve (which also didn't work for me).