key mismatch for docker build

[Paulo Roberto Massa Cereda]

Hi Kurt,

 > this is my first post. I am trying to create a docker build of the
 > texlive packages. I found one online, but it doesn't do the gpg
 > checking or shasum check.

Which one did you find? The one from the Island of TeX?
https://gitlab.com/islandoftex/images/texlive

We are trying to provide more or less all relevant TL builds to our 
users and are open to feature requests of all kinds. After reading your 
mail we immediately added such a check:

https://gitlab.com/islandoftex/images/texlive/-/commit/6620b936b174c4e6b4670aa221e05769ffd5fee4 
for sha512

and

https://gitlab.com/islandoftex/images/texlive/-/commit/000678d5533774adf6af7c8621186e1fdd9a61ef 
for gpg.

 > In my attempt to do this it appears to be working, except that the
 > install-tl-unx.tar.gzwas recently updated, (looks like it happened
 > today) and is causing a mismatch. It is not clear to me at first
 > glance to report issues like that or what the next steps would be to
 > resolving the issue.

Sometimes these mismatches are caused by mirrors updating their files. 
In this case, waiting a few minutes solves the problem. This is the most 
common cause we have found for such errors. For us, testing with a few 
mirrors, the shasum check succeeds.

 > I have read that gpg key things can be finicky, but would like to have
 > a reasonably secure way to grab the files and do the install. If
 > anyone has a docker build that  already does this, that would be
 > great.

 From now on, the Island of TeX build will do it. :)

If you need anything else, feel free to open feature requests there.

Cheerio,

Paulo

Em 05/10/2020 13:23, Kurt Sansom escreveu:
> Hi,
>    this is my first post. I am trying to create a docker build of the 
> texlive packages. I found one online, but it doesn't do the gpg 
> checking or shasum check.
> 
> In my attempt to do this it appears to be working, except that the 
> install-tl-unx.tar.gzwas recently updated, (looks like it happened today)
> and is causing a mismatch. It is not clear to me at first glance to 
> report issues like that or what the next steps would be to resolving the 
> issue.
> 
> I have read that gpg key things can be finicky, but would like to have a 
> reasonably secure way to grab the files and do the install. If anyone 
> has a docker build that  already does this, that would be great.
> 
> Regards,
>   ~Kurt
> -- 
> Kurt Sansom