On 02/09/2015 11:23 PM, Daniel Micay wrote:
Pacman uses a web of trust model. There are 5 trusted master keys and other keys are only trusted if either 3 master keys have signed them or the user has explicitly marked them as trusted. Never trust any keys yourself and you will have no issues. There is no MITM attack vector.
Today, I had the following situation:
:: Synchronizing package databases...
core is up to date
extra is up to date
community is up to date
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...
Packages (11) binutils-2.25-2 gcc-4.9.2-3 gcc-libs-4.9.2-3
glibc-2.21-1 inkscape-0.91-3 libiodbc-3.52.9-2
linux-api-headers-3.18.5-1 linux-firmware-20150206.17657c3-1
net-snmp-5.7.3-1 patch-2.7.4-1 virtualbox-4.3.20-5
Total Installed Size: 431.48 MiB
Net Upgrade Size: 5.52 MiB
:: Proceed with installation? [Y/n] y
checking keyring...
downloading required keys...
:: Import PGP key 2048R/02FD1C7A934E614545849F19A6234074498E9CEE,
"Christian Hesse (Arch Linux Package Signing)