[pacman-dev] [PATCH] (newgpg) Let pacman specify GnuPG's home directory.
gerbra at archlinux.de
Mon Dec 15 15:11:21 EST 2008
Am Mon, 15 Dec 2008 13:50:49 -0600
schrieb Chris Brannon <cmbrannon at cox.net>:
> Try removing trustdb from the gpg
> directory, while leaving pubring intact. You'll see what I mean.
> To summarize, it checks the signature if the key is found in pubring.
Yes, you're right. Got this in debug when the key is not trusted (no
error: Package /var/cache/pacman/pkg/abook-0.5.6-4-i686.pkg.tar.gz has
an invalid signature. abook-0.5.6-4-i686.pkg.tar.gz is invalid or corrupted
And this when the signing pubkey is trusted:
debug: installing packages
debug: found cached pkg: /var/cache/pacman/pkg/abook-0.5.6-4-i686.pkg.tar.gz
debug: loading target '/var/cache/pacman/pkg/abook-0.5.6-4-i686.pkg.tar.gz'
debug: no package signature file found
The last line confused me...
> I think pacman should at least complain if the signing key is not
> found in the public keyring. Thoughts?
IMHO pacman should refuse to install anything from core and extra if
the signature is not found or corrupted.
I don't know what to to with community (maybe a second keyring with
My thoughts were to make a option to each repo section in pacman.conf.
With this option: Keyring = /foo/bar we have an indicator that pacman
should check for correct signatures and users could have their
unsigned or self-signed repos additionally.
> -- Chris
More information about the pacman-dev