I’m trying to write a patch for bmaptool allowing it to verify a GPG signature with a custom keyring. My current understanding is, that I have to create a custom gpg home directory and import the keyring i want to use. So something along these lines:

context = gpg.Context(home_dir="/tmp/gpghome")
with open("/usr/share/keyrings/debian-keyring.gpg", "rb") as f:
    context.key_import(f.read())
context.verify(data, signature, None)

The problem with that approach is, that the key_import() function takes six minutes to complete. This is compared to running this:

gpgv --keyring=/usr/share/keyrings/debian-keyring.gpg file.asc file

Which takes 0.060s to finish. This means that the python equivalent currently takes 6000 times as long. Is there a better way to do this in Python?

Adjacent question: even after having waited for six minutes, context.verify still fails as the returned VerifyResult object has a summary=0 instead of one that matches gpg.constants.SIGSUM_VALID. What do I have to do to get working signature verification? Writing trust-model always into /tmp/gpghome/gpg.conf did not have the desired effect.