chore: update gpg command

[david-luna]

Which problem is this PR solving?

• gpg verify command failed when checking the integrity of codecov binary. Example https://github.com/open-telemetry/opentelemetry-js-contrib/actions/runs/19463307736/job/55698568099?pr=3225

Short description of the changes

• tweak the coverage script to pass the validation.

[david-luna]

Verification now is passing with mesage

Codecov binary missing. Downloading from https://cli.codecov.io/latest/linux/codecov
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 10.6M  100 10.6M    0     0  67.6M      0 --:--:-- --:--:-- --:--:-- 67.4M
Verifying codecov binary downloaded to "./codecov"
gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    73  100    73    0     0   1945      0 --:--:-- --:--:-- --:--:--  1972
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100   833  100   833    0     0  22354      0 --:--:-- --:--:-- --:--:-- 22513
gpg: Signature made Mon Nov 10 14:58:43 2025 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869

[pichlermarc]

Hmm, could it be that it was was actually failing due to the Cloudflare outage yesterday? It seems to work again now. Looking at the output from curl on the failing job, it seems to download a tiny file 15 bytes (Gateway Timeout happens to be 15 bytes encoded as UTF-8):

Codecov binary missing. Downloading from https://cli.codecov.io/latest/linux/codecov
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    15  100    15    0     0    265      0 --:--:-- --:--:-- --:--:--   267
Verifying codecov binary downloaded to "./codecov"
gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    73  100    73    0     0   1659      0 --:--:-- --:--:-- --:--:--  1659
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100    15  100    15    0     0    370      0 --:--:-- --:--:-- --:--:--   375
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
node:internal/errors:865
  const err = new Error(message);
              ^

Error: Command failed: gpg --verify "codecov.SHA256SUM.sig" "codecov.SHA256SUM"
    at checkExecSyncError (node:child_process:890:11)
    at execSync (node:child_process:962:15)
    at file:///home/runner/work/opentelemetry-js-contrib/opentelemetry-js-contrib/scripts/codecov-upload-flags.mjs:96:3
    at ModuleJob.run (node:internal/modules/esm/module_job:195:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:337:24)
    at async loadESM (node:internal/process/esm_loader:34:7)
    at async handleMainPromise (node:internal/modules/run_main:106:12) {
  status: 2,
  signal: null,
  output: [ null, null, null ],
  pid: 2236,
  stdout: null,
  stderr: null
}

[david-luna]

@pichlermarc I think you're right. I'm closing this and will check future runs