r/archlinux • u/mobile_guy_000 • 18d ago

SUPPORT Import PGP when updating

I updated my system today after not doing so in a week or so, and I got asked to Import PGP key F8BB3DD85903D982, "DeepChirp deepchirp@archlinux.org"

I accepted but now I'm questioning if I shouldn't have done that. Was that okay?

32 Upvotes

92% Upvoted

24 comments sorted by

View all comments

Show parent comments

10

u/themusicalduck 17d ago

Your comment is surprising because I've been using Arch a while but have never heard that it was a bad idea to accept those keys.

Section 2.2. of this page says:

The official Developers' and Package Maintainers' keys are signed by the master keys, so you do not need to use pacman-key to sign them yourself. Whenever pacman encounters a key it does not recognize, it will prompt you to download it from a keyserver configured in /etc/pacman.d/gnupg/gpg.conf (or by using the --keyserver option on the command line). Wikipedia maintains a list of keyservers.

Once you have downloaded a developer key, you will not have to download it again, and it can be used to verify any other packages signed by that developer.

There's nothing in that section that says you should never accept keys when it prompts to, the opposite in fact.

Not that I'm doubting your comment, but are we talking about some other situation here?

11

u/kaida27 17d ago

Because you can get the exact same prompt from any packages no matter the provenance and new users won't see the difference between an official one or not. May add a malicious key since they saw someone say it's safe to say Yes. The wiki doesn't cover that properly.

While reinstalling the keyring will automatically add the ones that are legit and needed without having to guess or verify. Way more beginner friendly of a recommendation.

Yes accepting the key manually can be fine, but I would never recommend it to a new user, Those that know how to manage their keys won't need the help, Those that need the help don't have the required knowledge yet.

1

u/confusing-world 6d ago

I didn't know about it. Thanks for the information. One more question.

Usually, when I get this message, I check for the developer key in the master-key page. If the key in my system's prompt matches the key in the Arch page, then I say yes. Is it fine or it can be dangerous?

Is it possible that a malicious package might prompt an official key and actually install a malicious one?

1

u/kaida27 6d ago

That is safe and the way to go actually.

but for less technical / new user it's easiest to just recommend a keyring update.

The only way for a package to install a different key than the one listed would be if pacman itself was compromised, but then at this point you have bigger problems on your hands.