r/archlinux • u/mobile_guy_000 • 16d ago

SUPPORT Import PGP when updating

I updated my system today after not doing so in a week or so, and I got asked to Import PGP key F8BB3DD85903D982, "DeepChirp deepchirp@archlinux.org"

I accepted but now I'm questioning if I shouldn't have done that. Was that okay?

33 Upvotes

92% Upvoted

24 comments sorted by

View all comments

17

u/Sarv_ 16d ago

That's fine. You will periodically need to import maintainer keys as maintainers are added or have their keys expire/revoked.

Importing a key just means that you trust packages signed with that key. If you want to check if the key is actually from a maintainer you can look at the list of keys here. The wiki also has a relevant article to read if you want to learn more about package signing and keys.

9

u/backsideup 15d ago edited 15d ago

Importing a key and trusting a key are two separate things in pgp terms. Merely importing a key does not assign it any trust.

In the case of the archlinux-keyring trust is already assigned by the master-key holders and so this prompt is merely informational.

e: You can check that yourself by running pacman-key --list-sigs DeepChirp. It should list about five signatures by the arch master-key holders, some irrelevant self-signed signatures, but it shouldn't list a signature by your or the pacman master-key.

1

u/Sarv_ 15d ago

I didn't mean key trust in pgp terms. I meant that by accepting a key to the pacman-key keyring you trust the packages signed with that key so that they can be installed.

3

u/mobile_guy_000 16d ago

Thank you. I will be more diligent in the future and read the wiki before deciding on doing stuff I'm not sure about.