> I had analyzed the original workflow with the skipped PGP tests:

>   https://github.com/koplas/roundup/actions/runs/13729858872/job/38404537982#step:19:24129

> due to missing gpg.

I missed that. It only installs it into the OS python installation. This could be the reason why it is not found. The package name is identical, so this should not be the issue.

> It would be good to have the steps you took to build that tarball in case we need to do this again in the future.

The steps were quite hacky and can not be upstreamed:
```sh
git clone git://git.gnupg.org/gpgmepy
cd gpgmepy
./autogen.sh
mkdir build && cd build && ../configure --enable-maintainer-mode --prefix=/usr && make

# edit setup.py in build folder
# setup(
#     name="gpg",
#     cmdclass={"build": BuildExtFirstHack},
#     version="2.0.0-beta4",
#     # Change BEGIN --------------------
#     package_data={
#         "": [
#             "../gpgme.i",
#             "../helpers.c",
#             "../helpers.h",
#             "../private.h",
#             "../version.py",
#         ]
#     },
#     # Change END ---------------------
#    # Note: description appears as Summary in egg-info file.
#     description="Python bindings to the GPGME API of the GnuPG cryptography library.",

cp version.py ../version.py
python -m build
```

`build/dist` now contains the source tar that can be uploaded to PyPi. If you want to maintain your own PyPi entry, edit the name parameter in the setup function to one that is not already used.

> I am even ok if we can't just 'pip install gpg' and have to do a full build as long as we have the directions for doing so.
If we do this, we need to add documentation for building the bindings, which I do not like. This can happen to various dependencies, resulting in half the world needing to be built to set up roundup. This should be fixed upstream; until then this https://pypi.org/project/gpgme/ can be used.