[nmglug] How to find/import public keys? Or is there another problem?

[Akkana Peck]

Tom Ashcraft writes:
> As my resources as an individual seem exhausted, I request assistance from
> the NMGLUG hive mind re:
> 
> tom at tom-HP-Notebook:~$ gpg --verify youtube-dl.sig /usr/local/bin/youtube-dl
> gpg: Signature made Fri 07 Jun 2019 02:48:58 PM MDT
> gpg:                using RSA key ED7F5BF46B3BBED81C87368E2C393E0F18A9236D
> gpg: Can't check signature: No public key                                

I'm curious where you got the /usr/local/bin/youtube-dl to verify.
I tried that recently, following the directions to use 
curl -L https://yt-dl.org/downloads/latest/youtube-dl -o youtube-dl
(I omitted the sudo part and ran it as a regular user) and I got a
file that starts with #!/usr/bin/env python, but then the rest of it
is binary data, not Python. "file" says it's Zip archive data, but
unzip won't unpack it because of that Python line at the beginning.
Verifying the signature seemed moot since the file wasn't usable.

I suspect Arlo's advice is probably  a better bet for youtube-dl
right now (even though the github README says to use curl):

Arlo Barnes writes:
> If you use `git clone`, doesn't it do key-checking as part of the commit
> tree verification process? That's how I got my latest copy of youtube-dl...

It's a little more complicated. If you git clone, then you also have
to install the package somehow. You could run python setup.py install
as root if you're sure you trust the git repository and you're not
worried about conflicting with your distro's youtube-dl package
(I prefer to avoid that). Otherwise, this might work:

python setup.py install --user

I've had weird results with --user so I did what the Python experts
recommend and set up a virtualenv, even though it's more steps:

python3 -m venv --system-site-packages ~/mypython3env
source ~/mypython3env/bin/activate
python setup.py install

You'll have to source ~/mypython3env/bin/activate every time you
want to run youtube-dl, though.

Or wait a week or two and maybe your distro will update their
youtube-dl package and you won't have to go through any of this.

        ...Akkana