rebuild-todo: Add the --import-keys option

[Antiz96]

Allows to import PGP keys for packages source verification into the user's keyring before rebuilding packages (including support for offloaded builds).

[felixonmars]

While I like this feature...

• I'd really like it to be part of pkgctl as it's much more widely useful than only here at rebuild-todo
• The keys we currently exported are sometimes broken (see https://gitlab.archlinux.org/archlinux/devtools/-/issues/93). I've been struggling with this for two years and have to generally prefer the keyservers instead of our exported keys.

[Antiz96]

While I like this feature...

I'd really like it to be part of pkgctl as it's much more widely useful than only here at rebuild-todo

Makes sense.
This MR is rather a quick workaround to address the pain point of having to manually import each PGP keys for each packages that require it for verification sources when using rebuild-todo; but I can look at upstreaming such a feature in a pkgctl import-keys subcommand if that's of interest.

The keys we currently exported are sometimes broken (see https://gitlab.archlinux.org/archlinux/devtools/-/issues/93). I've been struggling with this for two years and have to generally prefer the keyservers instead of our exported keys.

Correct me if I'm wrong but, while indeed annoying, that sounds like a separate issue to me. My idea here was solely to provide an easy way to massively import keys (for building purposes). If the keys haven't been exported correctly in the first place (for whatever reason) and are thus broken, it's a separate matter in my opinion. That should either be fixed at the export-pkgbuild-keys and / or at our packaging guidelines level from my perspective.

[Antiz96]

While I like this feature...
I'd really like it to be part of pkgctl as it's much more widely useful than only here at rebuild-todo

Makes sense. This MR is rather a quick workaround to address the pain point of having to manually import each PGP keys for each packages that require it for verification sources when using rebuild-todo; but I can look at upstreaming such a feature in a pkgctl import-keys subcommand if that's of interest.

@felixonmars I wrote a related comment in devtools repo at https://gitlab.archlinux.org/archlinux/devtools/-/issues/164#note_235778. We'll see how it goes. I'm putting this MR as a draft while waiting for some input on the devtools side.

[Antiz96]

Levente told me there are already some ongoing efforts to implement a keyring subcommand in devtools allowing to manage PGP keys with pkgctl :)
However, this seems like a rather big implementation that includes a re-definition of the way the keyring and keys will be managed for source verification (for instance to not rely on user's keyring anymore).

As such, I'm personally still interested for this solution to be implemented in rebuild-todo in the mean time. We can still update it to use the future pkgctl implementation later if it becomes a thing before rebuild-todo itself is integrated in pkgctl.

[christian-heusel]

Please drop the additional merge commit, then I think this is good to go 👍🏻

[Antiz96]

Please drop the additional merge commit, then I think this is good to go 👍🏻

Done ;)