From 3dc764ffa32deca63de3f5520cc9c99f4010e425 Mon Sep 17 00:00:00 2001 From: Joel Mangin Date: Sat, 25 Jul 2026 17:44:26 -0400 Subject: [PATCH 1/2] Work around a Codecov upstream key-import outage in CI. The coverage job's Codecov upload has been failing intermittently with "Could not verify signature. ... Can't check signature: No public key" -- confirmed as codecov/codecov-action#1955: the action's default CLI download path verifies a GPG signature against a key fetched from https://keybase.io/codecovsecurity/pgp_keys.asc, which has been returning 404 since ~2026-06-06. This is an outage on Codecov's side, not specific to this repo, and reproduces on the latest action version (v7.0.0) -- upgrading or retrying does not help. `use_pypi: true` is the maintainer-confirmed workaround: it sources the CLI from PyPI instead, skipping the broken key-import step entirely. Verified the Keybase URL is still returning 404 as of this commit. --- .github/workflows/main.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 40079ca..b0f6600 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -85,3 +85,13 @@ jobs: files: ./coverage/lcov.info fail_ci_if_error: true token: ${{ secrets.CODECOV_TOKEN }} + # codecov/codecov-action#1955: the action's default CLI download path + # verifies a GPG signature against a key fetched from + # https://keybase.io/codecovsecurity/pgp_keys.asc, which has been + # returning 404 since ~2026-06-06 -- an upstream Codecov outage, not + # anything specific to this repo. `use_pypi` sources the CLI from + # PyPI instead, skipping the broken key-import step entirely; this is + # the maintainer-confirmed workaround (still needed as of this commit + # even on the latest action version, v7.0.0). Safe to remove once + # Codecov restores the Keybase key. + use_pypi: true From ff95fcbdad0d88ea6889aa78bb8b9bacdc4b8bc7 Mon Sep 17 00:00:00 2001 From: Joel Mangin Date: Sat, 25 Jul 2026 18:14:07 -0400 Subject: [PATCH 2/2] Correct the root-cause explanation for the Codecov key-import failure. The previous commit's comment cited codecov/codecov-action#1955 and its dead codecovsecurity Keybase URL as the direct cause. Checked dist/codecov.sh at our pinned SHA (v7.0.0) directly: it actually fetches from a different host, codecovsecops, which resolves fine with a valid key when checked directly right now. So the failures observed here (twice, before this fix) are better explained as a transient failure somewhere in that external key-retrieval path, not the same dead URL from #1955 -- similar class of problem, not the same bug. Trimmed the in-file comment to the essentials; the full detail lives in the PR description and commit history instead of duplicated inline. --- .github/workflows/main.yaml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index b0f6600..15058b0 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -85,13 +85,9 @@ jobs: files: ./coverage/lcov.info fail_ci_if_error: true token: ${{ secrets.CODECOV_TOKEN }} - # codecov/codecov-action#1955: the action's default CLI download path - # verifies a GPG signature against a key fetched from - # https://keybase.io/codecovsecurity/pgp_keys.asc, which has been - # returning 404 since ~2026-06-06 -- an upstream Codecov outage, not - # anything specific to this repo. `use_pypi` sources the CLI from - # PyPI instead, skipping the broken key-import step entirely; this is - # the maintainer-confirmed workaround (still needed as of this commit - # even on the latest action version, v7.0.0). Safe to remove once - # Codecov restores the Keybase key. + # Works around intermittent "Can't check signature: No public key" + # failures on the action's default GPG-verified CLI download (see + # codecov/codecov-action#1955 for the same class of issue). Installs + # the CLI from PyPI instead, which skips that verification -- an + # availability fix, not a security-neutral one. use_pypi: true