Make the package signature verification actually work

The Docker image has not been buildable since v1.4.1. Adding
packages/CHECKSUMS.sha256.asc on 2026-07-15 switched on a verification branch
in the Dockerfile that had never once executed, and it failed immediately:
python:3.12.11-slim ships no gpg. Building v1.4.1 today reproduces it exactly.

The native path was broken too, for a different reason. bootstrap-linux.sh and
bootstrap-macos.sh call gpg --verify without ever importing the public key, so
on any machine that does not already have it in its keyring gpg exits 2 with
"No public key" and the script aborts the install. That is almost every user.

The public key is now in the repo. The copy published on the docs site could
not be imported at all: it was missing the blank line the armor format requires
between the header and the base64 body, so gpg rejected it as an invalid armor
header. That is fixed here.

The Dockerfile installs gnupg, imports the key, verifies, then purges gnupg in
the same layer so it does not reach the final image. The bootstrap scripts
import the bundled key, and when gpg is absent they now warn loudly and fall
through to the SHA-256 check instead of aborting: this tool is meant to run on
air-gapped machines where installing gnupg may be impossible, and refusing to
install there would fail in exactly the case it exists for.

Verified: the build prints Good signature from S.A.S.U. KATVIO (Fractum Release
Signing), the image is 260 MB with gpg absent from it, an encrypt/decrypt round
trip through the image with --network=none returns an identical SHA-256, two
shares below the threshold still fail, and the suite is 107 tests, 8/8 files.

Author: WhiteStarSupreme

Dockerfile

@@ -6,11 +6,22 @@ COPY setup.py README.md LICENSE TRADEMARK.md SECURITY.md bootstrap-linux.sh boot
 COPY src/ /app/src/
 COPY tests/ /app/tests/
 COPY packages/ /app/packages/
+COPY fractum-signing-key.asc /app/fractum-signing-key.asc
 
 # Install dependencies — verify offline packages if present (M6)
+# La verification GPG etait inoperante depuis la v1.4.1 : le fichier .asc a ete
+# ajoute le 2026-07-15, ce qui a active cette branche pour la premiere fois,
+# alors que l'image de base ne contient pas gpg et que la cle publique n'etait
+# nulle part. L'image n'etait donc plus constructible du tout. On installe
+# gnupg, on importe la cle du depot, et on verifie pour de bon.
 RUN if [ -f packages/CHECKSUMS.sha256 ] && [ -f packages/CHECKSUMS.sha256.asc ]; then \
-      gpg --verify packages/CHECKSUMS.sha256.asc packages/CHECKSUMS.sha256 \
+      apt-get update && apt-get install -y --no-install-recommends gnupg; \
+      gpg --batch --quiet --import /app/fractum-signing-key.asc \
+        || { echo "ERROR: cannot import the Fractum signing key"; exit 1; }; \
+      gpg --batch --verify packages/CHECKSUMS.sha256.asc packages/CHECKSUMS.sha256 \
         || { echo "ERROR: Invalid GPG signature on packages"; exit 1; }; \
+      apt-get purge -y gnupg && apt-get autoremove -y \
+        && rm -rf /var/lib/apt/lists/* /root/.gnupg; \
     fi; \
     if [ -f packages/CHECKSUMS.sha256 ]; then \
       (cd packages && sha256sum --check CHECKSUMS.sha256 --strict --quiet) \

bootstrap-linux.sh

@@ -11,13 +11,35 @@ PYENV_INSTALLER_SHA256="4b0adf623a6205727163eb98610b6c5e63f23b99183948b874d867cd
 # Requires packages/CHECKSUMS.sha256 — GPG signature in packages/CHECKSUMS.sha256.asc if present.
 verify_packages() {
   local pkg_dir="${1:-packages}"
+  local key_file="${2:-fractum-signing-key.asc}"
   echo "→ Verifying package integrity..."
 
+  # La signature ne se verifiait jamais : le script appelait gpg sans jamais
+  # importer la cle publique, donc gpg sortait en « No public key » et le
+  # script abandonnait l'installation. La cle est desormais dans le depot.
+  #
+  # Si gpg est absent, on continue au lieu d'abandonner, et on le dit. Cet
+  # outil est fait pour tourner sur une machine coupee du reseau, ou installer
+  # gnupg peut etre impossible ; refuser l'installation la ferait echouer
+  # precisement dans le cas d'usage qu'elle vise. Les sommes SHA-256 restent
+  # verifiees juste apres, dans tous les cas.
   if [ -f "${pkg_dir}/CHECKSUMS.sha256.asc" ]; then
-    echo "→ Verifying GPG signature on packages (key D009F6290DCFDAB6)..."
-    gpg --verify "${pkg_dir}/CHECKSUMS.sha256.asc" "${pkg_dir}/CHECKSUMS.sha256" \
-      || { echo "ERROR: Invalid GPG signature on packages — installation aborted"; exit 1; }
-    echo "  ✓ GPG signature valid"
+    if command -v gpg >/dev/null 2>&1; then
+      echo "→ Verifying GPG signature on packages (key D009F6290DCFDAB6)..."
+      if [ -f "${key_file}" ]; then
+        gpg --batch --quiet --import "${key_file}" \
+          || { echo "ERROR: cannot import ${key_file} — installation aborted"; exit 1; }
+      else
+        echo "  WARNING: ${key_file} not found — relying on a key already in your keyring"
+      fi
+      gpg --batch --verify "${pkg_dir}/CHECKSUMS.sha256.asc" "${pkg_dir}/CHECKSUMS.sha256" \
+        || { echo "ERROR: Invalid GPG signature on packages — installation aborted"; exit 1; }
+      echo "  ✓ GPG signature valid"
+    else
+      echo "  WARNING: gpg not installed — the signature on CHECKSUMS.sha256 was NOT checked."
+      echo "           Only the SHA-256 hashes below are verified. Install gnupg and re-run"
+      echo "           this script to check who signed them."
+    fi
   else
     echo "  WARNING: ${pkg_dir}/CHECKSUMS.sha256.asc not found — skipping GPG verification"
     echo "           For production use, obtain the .asc from a trusted Katvio release."

bootstrap-macos.sh

@@ -10,13 +10,35 @@ HOMEBREW_INSTALLER_SHA256="2863708cb516c5d0bcdfff97dc13bffb61db93f7acc6ae559a559
 # Verify offline packages before installation (M6)
 verify_packages() {
   local pkg_dir="${1:-packages}"
+  local key_file="${2:-fractum-signing-key.asc}"
   echo "→ Verifying package integrity..."
 
+  # La signature ne se verifiait jamais : le script appelait gpg sans jamais
+  # importer la cle publique, donc gpg sortait en « No public key » et le
+  # script abandonnait l'installation. La cle est desormais dans le depot.
+  #
+  # Si gpg est absent, on continue au lieu d'abandonner, et on le dit. Cet
+  # outil est fait pour tourner sur une machine coupee du reseau, ou installer
+  # gnupg peut etre impossible ; refuser l'installation la ferait echouer
+  # precisement dans le cas d'usage qu'elle vise. Les sommes SHA-256 restent
+  # verifiees juste apres, dans tous les cas.
   if [ -f "${pkg_dir}/CHECKSUMS.sha256.asc" ]; then
-    echo "→ Verifying GPG signature on packages (key D009F6290DCFDAB6)..."
-    gpg --verify "${pkg_dir}/CHECKSUMS.sha256.asc" "${pkg_dir}/CHECKSUMS.sha256" \
-      || { echo "ERROR: Invalid GPG signature on packages — installation aborted"; exit 1; }
-    echo "  ✓ GPG signature valid"
+    if command -v gpg >/dev/null 2>&1; then
+      echo "→ Verifying GPG signature on packages (key D009F6290DCFDAB6)..."
+      if [ -f "${key_file}" ]; then
+        gpg --batch --quiet --import "${key_file}" \
+          || { echo "ERROR: cannot import ${key_file} — installation aborted"; exit 1; }
+      else
+        echo "  WARNING: ${key_file} not found — relying on a key already in your keyring"
+      fi
+      gpg --batch --verify "${pkg_dir}/CHECKSUMS.sha256.asc" "${pkg_dir}/CHECKSUMS.sha256" \
+        || { echo "ERROR: Invalid GPG signature on packages — installation aborted"; exit 1; }
+      echo "  ✓ GPG signature valid"
+    else
+      echo "  WARNING: gpg not installed — the signature on CHECKSUMS.sha256 was NOT checked."
+      echo "           Only the SHA-256 hashes below are verified. Install gnupg and re-run"
+      echo "           this script to check who signed them."
+    fi
   else
     echo "  WARNING: ${pkg_dir}/CHECKSUMS.sha256.asc not found — skipping GPG verification"
     echo "           For production use, obtain the .asc from a trusted Katvio release."

fractum-signing-key.asc

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGhVV44BEADFfKn8UJ+N0TeCS8uRKi8qYotXPR8Z4yMGINlT/S95vGf0JiHo
+fmcu9ZGp+ivw/YE3x9KDk1AzCiwbiQ8ownhsYQU5vTKt8LsF4PObGSlRQetmwvkw
+exkP5/Toohrx3UFxrHhail2DqZNzgZaEWvf9NjM0XXjA9kiLXcX2VBfUo1uXuDp9
+4QsjxwZu+QCtTVrkm/imqT/Ji1mndb2M9kBRXIu8wMq+YI+/zCDwdnD5M3eek3rR
+PM33yb4oIMjJIf9kTN9doA61hGPPH0idXx7IjKibbuDeZEGvLwRXSHy5ORFwZANF
+nGVVWOY/fQaVE3G5CHhpNVKVjMQOUdng7YKwZV8n/uD5cIfJUuggZKNZUccHENOY
+FR3aB5FJdxzy/Rq3vqt4ASkaThasA0XeMf+yP6p2opzcTYQJAMbQLKvbu5t5fvET
+BXmWa6O35/nlRBV6My7pUR2XQPe4MTO/lBHPcs9xpsSrD5ZTygb11QKaWOY3SSgq
+6nh9TRamo8Z6/hI79TCfbji4FcRJywBBTsnEv7dBFKi5f0gNDagL+otIrjEDNeOI
+6z1R8bwAJ3++ATfeQ/DSC2SoE/6T2DY5B4B7NNuqmf5fkZbGG4VYRWg0UqD8r5be
+tzzDFn34btItgDj/PumByYtoR6P5cRv8gKBnOJPYrFvKfvKlnEViGaGd4wARAQAB
+tD5TLkEuUy5VLiBLQVRWSU8gKEZyYWN0dW0gUmVsZWFzZSBTaWduaW5nKSA8Y29u
+dGFjdEBrYXR2aW8uY29tPokCUQQTAQgAOxYhBBed8ktubj2K79mnldAJ9ikNz9q2
+BQJoVVeOAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJENAJ9ikNz9q2
+gi0P/iI0HdlZ4A3+ch2iXVRVLJZfpA/7tlbHgi+1sn6oX+0a3LsbnNR1FmJxY+kI
+BqWaC9NebI5DpuGOgua86rMVyXB+IBABObBd/JRbnkVnmeYzJBWmD3NZeMnFsGdZ
+Umruc1wwvs1KAfuM3phnTDhIFStSCgMRHZ6KgnIrC42aAOZryCh6J0S/nC6hUjow
+NLzwaoNHnxsrzDB/sBS9FkjIsbeuoBvFm/Z2mtBEpCSiBZsOJPz4e3ClaN7uFDNb
+TBjfVt84b2pqZu9ILdWnW/TZx+b2vwxn+z9X7xYew4ZaDzWMrBLBxgua1pA41cyI
+dCUtuJ9Pb5U0TUL1LWns3aiYxLRBR8NO5FiAcs8dgrnNfr+qQWHngFo/7gIR5AGn
+0s53bkj8zT89Ptre2s+k0FiivuhYF5atuUVThDeU5eNM0Oj1LoWgD+qeadCDz37Z
+VfOi8fICA779fB6lJxdb73Wfp6AxLv2Amssf5Li1m4sUmcuUmMkLXI6ciOKlz8/a
+UOqpBoFMayWrxcwV+4Bx6+aA+TlVaDZ1P3gys2eX/OREemnjzMAVkbdkkM8EGbAC
+FYik9g465ETkTcNsEHBIp1tZtXdV01L30T0KzNe0zfwPlZODVqIOMjsR3EkWKuBH
+/I6I0MrRm03Qh3Umoe4/8eC7JM3VHX83Vb4v+dL7KKhPdNukuQINBGhVV44BEAC0
+PZWGsJW8biyZPFJmE0bYshVr/I/4w7VYQ9gs76byltWoJ43FzOPTf9nGq2dB/tHG
+Zg3I2IFo0r7FSN58kqzXYg235IMVXqKyQ/DOu4Zgt+bHVG9mta2rRcpKcN8kV8k+
+umPHgS+Xa1CjXpObp2pVjT+jsdQ6nV196fYI8koE9TVPXlIIDXXtb8aNik7/Bx2b
+PMnD1tWrm2mGYGED+85dPdSXUjPeP7ha5ch0mGhK6vBDwrRhkWKr7zGi+VEIqU/Y
+ar6cYSITV/ZQ0IOM6TVSBKcIKAKzHPV4/BN8EiNEmQR3/gu4qIE89blB3GwXiKyB
+FbIifVC2/a000L2ii9zBpGCteUO6BJ4UqK0Wp7dw1fchRe0c4MCTziPX5J/ZN18w
+ZUYwAO6AHlgqdURbU5LBvKk/i48B3vD+it7Nl41ivejFVXTgOPJSFY1QGk9IPJdp
+3xY1RRkZXfCCbR1TcQlcAMEhnHW/AXm80yNqF4ghJyv6rBBXXjgMtq5kKM0MqGgQ
+N9pUsJZ8bRaWTAzGB+diZsnNfpf1khn6RvJIv4bnnOu3L7UPTXmlBmu5tqbwQvUH
+IBae+FNWq2jY4LjY2BSOTWOjphM9ubVeUv+w45Rf2/jMblWylWc3bNz6S5uSy435
+UpQd0+kuwT8lXyODzGxV94xhaA0C82Dz+FqZQrdtGQARAQABiQI2BBgBCAAgFiEE
+F53yS25uPYrv2aeV0An2KQ3P2rYFAmhVV44CGwwACgkQ0An2KQ3P2rav+Q/+PGNs
+ubHDn7xR9uViMiD5QpFdAvOK0Itmjnf6aG14qt5wTB3y+wgS1k6OVcQkX1SSiac4
+x3HpacB43x8AuyF/Gw0ufMAmEPUyUl+pnYIZ4JKX08Eux/LI0VApYKPQbnHD+4qx
+w9Mcr7+5JQXWv7FQkpcZ5K3ycvkCCiqJ65xl2J9CIF41o0lJPpxAiOLzDr2Cjzku
+XHk5qr3kKBlwWf27ORhOoESS2bqRSw3ZBMP+zuan6yaPSWJnlUBEHZHIB8a/sKLL
+U7+QIXNKYur51sFuZIWGm/LlUDEW7e98Xk6BwmqpJzrWbrDV3fN33J511z0/4Dzb
+SbzBKXVQ+L7Ec50aRH5OEWbTQxBtpCLVg1aThsQ6+DWKWGEDppy7T8HIPM0YelGb
++WqYLaaX9FnXpe6NAOUcm62w+sM4bi2vNhAMW2kIAve2l21zm9p4dmdwp2JofGGi
+KOyRimwkDkMBXm6gOUHzHAdLsFIEipM5dvO/AddZD48KuKtecuAMYlioDiNdqW+s
+cIgcDiLzGbq8CNMZffmbMeilLf8HLIpPYMT04mSFCEbSjywxpao9ugz66h/Zbcxr
+8MpfB7kLubffsg18Ts9uv3TfN1WSrhLwy9QSeXW1DlrLzrgTxNsDSVt9GqSIK+cE
+UVsMvssUriCsGsRic1x7Cr8oAslNY6jJqSapoXQ=
+=CkRq
+-----END PGP PUBLIC KEY BLOCK-----