We can discuss this in one of our meetings.

Adding this to our kde-update-scripts looks fairly easy.

That being said: adding this to the spec files sounds like a good idea.

We'd probably want to package the keyring so we don't have to add it as a source to every package.

Made a pull request to add it to https://github.com/xsuchy/distribution-gpg-keys/pull/118 which is packaged in Fedora:
https://packages.fedoraproject.org/pkgs/distribution-gpg-keys/distribution-gpg-keys

Could package it separately if that is easier or if there are many other KDE specific keys that it would be useful to have.

I figured we'd ship the keyrings as a subpackage of the kf6 package, so that we can ship macros for making it easier to do gpg verification of kde sources.

Ok, will make a pull request to https://src.fedoraproject.org/rpms/kf6

https://src.fedoraproject.org/rpms/kf6/pull-request/8

Things we need to do:

• verify there is only one key for signing packages (or more if that is the case) and add them to KF6 package
• create a _kf6 gpgverify macro to simplify our process
• update packages! :-)

We should also update the kde-update-scripts to do an extra layer of verification

Thanks for the feedback. Is it ok to start with one or two packages first? There will likely be other keys since not all KDE packages are in KDE Gear. Would probably want the macro to have an argument to specify the key to be used.

Status update on this issue:
- kde-release-keyring was created
- .sig Source1 files have been added to all Plasma and Frameworks packages ( Gear remaining)
- Awaiting resolution of this ticket to proceed with adding gpg verification to the spec files