Arch Linux

We'd better paste the origin upstream key link to verify.

The attached fix-source.patch is for an issue in virt-viewer?

Sorry for mistakenly uploaded the wrong patch.
Here is the correct patch :)

gpg key comes from "github user gpg": https://github.com/jelmer.gpg

The key from fix-gpg.patch resolves the issue. However if I run export-pkgbuild-keys at that point it cleans the key back to the state it was before the patch was applied. Is this an issue in devtools or with the key or something else?

in source file of export-pkgbuild-keys, has command like this:

gpg --output "$TEMPDIR/$key.asc" --armor --export --export-options export-minimal "$key" 2>/dev/null
...
mv "$TEMPDIR/$key.asc" "keys/pgp/$key.asc"

"--export-options export-minimal" means "removes all signatures except the most recent self-signature on each user ID"(from man gpg).
while patched key file in key/gpg/ contains all signatures from pub key, so in result it seems to be reversed.
(the github author seems signing the commit with a subkey other than "the most recent self-signature one")
(just my personal thought)

Should be this case: https://gitlab.archlinux.org/archlinux/devtools/-/issues/93

Close this in favor of the devtools issue? Deferring to PM's better judgement.