[arch-general] Missing gpg key?
Hello. I try to recompile lib32-libgcrypt - because of this annoying error: libGL: dlopen /usr/lib32/xorg/modules/dri/radeonsi_dri.so failed (/usr/lib32/libgcrypt.so.20: symbol gpgrt_lock_lock, version GPG_ERROR_1.0 not defined in file libgpg-error.so.0 with link time reference) and makepkg says : [steev]/tmp/lib32-libgcrypt > LC_ALL=C LANG=en makepkg ==> Making package: lib32-libgcrypt 1.7.0-1 (Fri Jun 3 20:47:43 CEST 2016) ==> Checking runtime dependencies... ==> Checking buildtime dependencies... ==> Retrieving sources... -> Found libgcrypt-1.7.0.tar.bz2 -> Found libgcrypt-1.7.0.tar.bz2.sig ==> Validating source files with sha1sums... libgcrypt-1.7.0.tar.bz2 ... Passed libgcrypt-1.7.0.tar.bz2.sig ... Skipped ==> Verifying source file signatures with gpg... libgcrypt-1.7.0.tar.bz2 ... FAILED (unknown public key 2071B08A33BD3F06) ==> ERROR: One or more PGP signatures could not be verified! All keys refreshed: gpg: refreshing 85 keys from hkp://pool.sks-keyservers.net [...] gpg: Total number processed: 84 gpg: unchanged: 84 Missing key, or sth went really wrong? Regards Sławek
https://wiki.archlinux.org/index.php/Makepkg#Signature_checking "If a needed public key is missing, or if you want to add public keys by other developers, you can import it manually, or you can find it on a keyserver and import it from there. Alternatively, you can temporarily disable makepkg's signature checking, by calling makepkg with the --skippgpcheck option." On 06/03/2016 09:34 PM, Sławomir Szczyrba wrote:
Hello.
I try to recompile lib32-libgcrypt - because of this annoying error: libGL: dlopen /usr/lib32/xorg/modules/dri/radeonsi_dri.so failed (/usr/lib32/libgcrypt.so.20: symbol gpgrt_lock_lock, version GPG_ERROR_1.0 not defined in file libgpg-error.so.0 with link time reference)
and makepkg says :
[steev]/tmp/lib32-libgcrypt > LC_ALL=C LANG=en makepkg ==> Making package: lib32-libgcrypt 1.7.0-1 (Fri Jun 3 20:47:43 CEST 2016) ==> Checking runtime dependencies... ==> Checking buildtime dependencies... ==> Retrieving sources... -> Found libgcrypt-1.7.0.tar.bz2 -> Found libgcrypt-1.7.0.tar.bz2.sig ==> Validating source files with sha1sums... libgcrypt-1.7.0.tar.bz2 ... Passed libgcrypt-1.7.0.tar.bz2.sig ... Skipped ==> Verifying source file signatures with gpg... libgcrypt-1.7.0.tar.bz2 ... FAILED (unknown public key 2071B08A33BD3F06) ==> ERROR: One or more PGP signatures could not be verified!
All keys refreshed: gpg: refreshing 85 keys from hkp://pool.sks-keyservers.net [...] gpg: Total number processed: 84 gpg: unchanged: 84
Missing key, or sth went really wrong?
Regards Sławek
Le 03/06/2016 à 21:34, Sławomir Szczyrba a écrit :
Missing key, or sth went really wrong?
Regards Sławek
Because you do not have key 2071B08A33BD3F06 in your keyring, it is from libgcrypt developers, not ArchLinux. You can retreive the key with gpg --recv-keys <fingerprint> or pass --skippgpcheck to makepkg -- Laurent Carlier http://www.archlinux.org
I know. Just being a bit wary, with packages like gpg or crypt :)
https://wiki.archlinux.org/index.php/Makepkg#Signature_checking
"If a needed public key is missing, or if you want to add public keys by other developers, you can import it manually, or you can find it on a keyserver and import it from there. Alternatively, you can temporarily disable makepkg's signature checking, by calling makepkg with the --skippgpcheck option."
On 06/03/2016 09:34 PM, Sławomir Szczyrba wrote:
Hello.
I try to recompile lib32-libgcrypt - because of this annoying error: libGL: dlopen /usr/lib32/xorg/modules/dri/radeonsi_dri.so failed (/usr/lib32/libgcrypt.so.20: symbol gpgrt_lock_lock, version GPG_ERROR_1.0 not defined in file libgpg-error.so.0 with link time reference)
and makepkg says :
[steev]/tmp/lib32-libgcrypt > LC_ALL=C LANG=en makepkg ==> Making package: lib32-libgcrypt 1.7.0-1 (Fri Jun 3 20:47:43 CEST 2016) ==> Checking runtime dependencies... ==> Checking buildtime dependencies... ==> Retrieving sources... -> Found libgcrypt-1.7.0.tar.bz2 -> Found libgcrypt-1.7.0.tar.bz2.sig ==> Validating source files with sha1sums... libgcrypt-1.7.0.tar.bz2 ... Passed libgcrypt-1.7.0.tar.bz2.sig ... Skipped ==> Verifying source file signatures with gpg... libgcrypt-1.7.0.tar.bz2 ... FAILED (unknown public key 2071B08A33BD3F06) ==> ERROR: One or more PGP signatures could not be verified!
All keys refreshed: gpg: refreshing 85 keys from hkp://pool.sks-keyservers.net [...] gpg: Total number processed: 84 gpg: unchanged: 84
Missing key, or sth went really wrong?
Regards Sławek
Pozdrawiam, Sławek -- ________ Q: How many chickens does it take to screw in a light bulb? _/ __/ __/ A: Two-one to do it and one to cross the road. \__ \__ \_______________________________________________________________ /___/___/ Sławomir Szczyrba steev(AT)hot.pl
On Fri, 3 Jun 2016 21:42:05 +0200, Laurent Carlier wrote:
You can retreive the key with gpg --recv-keys <fingerprint> or pass --skippgpcheck to makepkg
IMO skipping the verifying isn't a good approach. Instead of typing gpg -h and then gpg --recv-keys I added an alias, since I seldom need to import a key and can't remember what abbreviation for "receive" is used ( http://www.abbreviations.com/abbreviation/Receive ;). $ grep gkey ~/.bashrc alias gkey='gpg --keyserver hkp://pgp.uni-mainz.de --recv-keys' IIRC an uncommented line "keyserver-options auto-key-retrieve" in gpg.conf automatically imports missing keys. $ grep auto ~/.gnupg/gpg.conf # keyserver-options auto-key-retrieve Regards, Ralf
participants (4)
-
Laurent Carlier
-
Ralf Mardorf
-
Sławomir Szczyrba
-
Wilhelm Schuster