35

I recently switched to an arch based distro call Manjaro.

I have problems installing some packages from the aur arch repository

    curl-7.54.0.tar.gz ... Passed
    curl-7.54.0.tar.gz.asc ... Skipped
==> Verifying source file signatures with gpg...
    curl-7.54.0.tar.gz ... FAILED (unknown public key 5CC908FDB71E12C2)
==> ERROR: One or more PGP signatures could not be verified!

What do I need to do to fix this?

Improve this question
1
  • 1
    or you could do makepkg -s --skippgpcheck
    – STEEL
    Nov 22, 2020 at 16:57

1 Answer 1

Reset to default
47

Once you have local gpg key pair, you can import the unknown key to your local users set of keys. In my case, the key 5CC908FDB71E12C2 needs to be imported as follows.

$ gpg --recv-keys 5CC908FDB71E12C2
gpg: keybox '/home/user/.gnupg/pubring.kbx' created
gpg: key 5CC908FDB71E12C2: 8 signatures not checked due to missing keys
gpg: /home/aaron/.gnupg/trustdb.gpg: trustdb created
gpg: key 5CC908FDB71E12C2: public key "Daniel Stenberg <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

--recv-keys key IDs: Import the keys with the given key IDs from a keyserver.

If the above fails you might need to generate a local gpg keystore/database.

This below steps may no longer be necessary as the above step now creates a local key database for you. This depends on your distro and gpg version and config.

If you do not already have a gpg key database for your local user.

gpg --generate-key

or 

gpg --full-gen-key

What the docs say.

   --generate-key
   --gen-key
          Generate  a  new key pair using the current default parameters.  This is the standard command to create a new key.  In addition to the key a revocation certificate is created and stored in the
          ‘openpgp-revocs.d’ directory below the GnuPG home directory.

   --full-generate-key
   --full-gen-key
          Generate a new key pair with dialogs for all options.  This is an extended version of --generate-key.

          There is also a feature which allows you to create keys in batch mode. See the manual section ``Unattended key generation'' on how to use this.
Improve this answer
8
  • Is this safe? Like, doesn't adding random keys whenever you have to, defeat the purpose...?
    – jcora
    Feb 14, 2018 at 11:44
  • 5
    @jcora. These keys allow you to install the software you want. You need to decide if it is safe. These are third-party keys the verify that the software they have created in AUR is actually from them. Is there a possibility of a package in AUR or somewhere having malicious code yes. Which requires you to trust that the person creating the package. Beyond that, the keys verify that no one else has modified the package you received. You have to make the decision and evaluate the risk.
    – nelaaro
    Feb 14, 2018 at 13:16
  • well I was confused because usually the keys for AUR packages are already automatically included on my system. Am I misunderstanding something?
    – jcora
    Feb 15, 2018 at 15:07
  • I am using the Manjor distro, which was probably out of date, and causing issues for me.
    – nelaaro
    Feb 15, 2018 at 19:09
  • 1
    @EnricoMariaDeAngelis the local gpg keys are not initialised, you do not have a key ring which is just a file that stores a list of keys that you have imported / accepted. --full-gen-key ensures that all files are created for you to be able to import keys to your local key ring.
    – nelaaro
    Aug 13, 2018 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .