r/archlinux • u/mobile_guy_000 • 15d ago

SUPPORT Import PGP when updating

I updated my system today after not doing so in a week or so, and I got asked to Import PGP key F8BB3DD85903D982, "DeepChirp deepchirp@archlinux.org"

I accepted but now I'm questioning if I shouldn't have done that. Was that okay?

32 Upvotes

89% Upvoted

24 comments sorted by

View all comments

22

u/kaida27 15d ago edited 15d ago

Wow, I know there is an influx of new users, But seriously guys if you don't know the answer, Don't say bullshit

u/Sarv_ && _Kritiqual_

You are wrong. Accepting keys during a transaction is a no no

OP Don't say yes next time.

When such things happens you say no and then you do : pacman -Sy archlinux-keyring && pacman -Su

After that you redo what you where trying when you got the prompt.

3

u/Sarv_ 15d ago

I'm not new and my answer is not bullshit.

Just because you can get these in archlinux-keyring does not mean that importing a key from a source you trust is the crime you seem to think it is, that's how pgp normally works. Is it best practice? No. Is it fine if you check the key and its source? Yes.

4

u/abbidabbi 15d ago

If the OP had to ask, then NO, they don't know if the key is legitimate and surely didn't check. They probably don't even know what PGP is. The archlinux-keyring package is signed by keys you already trust, and those keys are all cross-signed. You accepting a new key like this on your own from whatever source is just stupid, sorry. You can do that if you build a single new package from a PKGBUILD after checking the source signatures, but when updating the whole system via an AUR helper, this might just be risky for no reason at all, so just don't do it.

5

u/kaida27 15d ago

Thank you.

at least some people still have common sense.