Homebrew GPG signature expiry enforcement for bottle installation

Answer

Homebrew does not provide a dedicated configuration flag to treat an expired GPG signing key as a hard error; bottle verification relies on GPG's own expiry handling, and cached credentials are managed by the system keyring, not Homebrew.

Confirmed facts

• Homebrew always runs GPG verification on bottles; if the signing key is expired, GPG rejects the signature and installation fails.
• Expired cached GPG credentials are not automatically cleared by Homebrew; they are subject to the keyring's expiry rules.
• When an expired key is detected but the bottle file remains downloadable, the correct boundary is to block the installation, because a valid signature is required before use.

Likely explanation

Homebrew's bottle installation process checks the GPG signature of the downloaded file. The check uses the HOMEBREW_GPG_KEYS environment variable or the default keyring. If the key's primary signature has expired, GPG returns an error and Homebrew aborts the install. There is no Homebrew‑level switch to treat expiry as a fatal error separate from GPG's own verification.

Steps to enforce expiry enforcement

1. Ensure the GPG key used for bottle signing is present in the user's keyring and not revoked. Verify with gpg --list-keys and check the expires date.
2. Optionally set HOMEBREW_GPG_KEYS to point to a dedicated keyring that contains only the trusted signing key, e.g. export HOMEBREW_GPG_KEYS=$HOME/.gnupg/bottles.gpg.
3. Run a test install with verbose output: brew install --verbose . Look for GPG error messages indicating “key expired” or “bad signature”.
4. If the key is expired, remove or replace it in the keyring and repeat the install; Homebrew will then reject the bottle.

Is the GPG signing key present and trusted in the user's keyring?