[pkgrepo.managed] broken on Debian trixie when using keyserver-based GPG key downloads

[brevilo]

Symptom

When using pkgrepo.managed with keyserver/keyid you'll eventually run into this (after the key got downloaded, the repo source got installed and apt update is run):

Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/etc/apt/keyrings/key.gpg"  Caused by:     0: Reading "/etc/apt/keyrings/key.gpg": EOF     1: EOF

Analysis

add_repo_key() retrieves the key in a format that's not suitable anymore for Debian trixie. To quote the upstream manpage:

To generate keys suitable for use in APT using GnuPG, you will need to use the gpg --export-options export-minimal [--armor] --export command. Earlier solutions involving --keyring file --import no longer work with recent GnuPG versions as they use a new internal format ("GPG keybox database").

Solution

Works for me:

gpg --keyserver <KEYSERVER> --recv-keys <KEYID> && \
gpg --armor --export --export-options export-minimal <KEYID> > <KEYDIR>/<KEYFILE>