Re: Is including GPG keys in an AUR package for verifying sources a good idea?

On 2/20/24 03:34, David Runge wrote:

Closing I would like to add that with*any* sort of signature and authenticity claim it is on the consumer to verify, validate and trust this claim. The PKGBUILDs (and any verification scheme that may come along with it) offered in the AUR are "unsupported" for a reason.

Best, David

You are AWESOME, Yes the Certificate spamming is what I was referring to. However going from memory, "malware" was what I came up with to describe what the miscreants were doing to the keyservers. Thank you for your detailed solutions -- that is exactly what information is needed. -- David C. Rankin, J.D.,P.E.