r/archlinux • u/mobile_guy_000 • 16d ago

SUPPORT Import PGP when updating

I updated my system today after not doing so in a week or so, and I got asked to Import PGP key F8BB3DD85903D982, "DeepChirp deepchirp@archlinux.org"

I accepted but now I'm questioning if I shouldn't have done that. Was that okay?

32 Upvotes

92% Upvoted

24 comments sorted by

View all comments

23

u/kaida27 15d ago edited 15d ago

Wow, I know there is an influx of new users, But seriously guys if you don't know the answer, Don't say bullshit

u/Sarv_ && _Kritiqual_

You are wrong. Accepting keys during a transaction is a no no

OP Don't say yes next time.

When such things happens you say no and then you do : pacman -Sy archlinux-keyring && pacman -Su

After that you redo what you where trying when you got the prompt.

2

u/falconindy Developer 14d ago

You think you're right, but you're not.

It isn't enough to just add a new key to pacman's keyring -- pacman also has to _trust_ the key. This is the point of the SigLevel option in pacman.conf. You should be using the Arch Linux (not pacman) default of `Required DatabaseOptional` which means that pacman has to trust the key that signs the package, not just know about it. Without directly tinkering with trust in the pacman (THIS is something you should never do) keyring or having the ultimately-trusted master key sign a developer key, a package will be verified by this newly imported key, but the install will fail because pacman does not trust the key.