You are not logged in.
I have to downgrade some packages (linux package due to ath5k problem), but pacman won't allow me because of the signatures.
I downloaded the packages i need from here http://schlunix.org/archlinux/.
These packages are safe to install? How can i bypass the signature check, if these packages are safe to install?
Thanks.
Last edited by Hyugga (2012-04-19 19:46:23)
Offline
If you have a pgp key, you can sign the packages with your own key. You can do this by editing /etc/makepkg.conf, adding your key to the GPGKEY="" section and enabling the sign option in the BUILDENV section. When building the package, it'll then be signed with your personal key. Afterwards import your key in pacman (pacman-key -r <yourkey>), assign the proper trust level and you're good to go.
A workaround is to temporarily set "SigLevel = Never" in your /etc/pacman.conf (and hence disabling keysigning).
EDIT: I just bothered to actually check your link and you'll be installing prebuilt binaries, so my first explanation doesn't apply there (you won't be building anything). So just setting SigLevel to Optional or Never (temporarily) should do.
Last edited by Gcool (2012-04-19 19:23:05)
Burninate!
Offline
Ok, thanks. I can disable the keysigning, but it's safe? How can i have my own pgp key? is it PGP or GPG?
Last edited by Hyugga (2012-04-19 19:33:51)
Offline
Actually, I just took a second look (it's getting late here, so I'm a bit slow) and the packages are actually all signed. If you simple download the .sig file along with the package; you shouldn't have to disable anything.
Burninate!
Offline
It worked! Thanks a lot Gcool!
Marking as solved.
Offline
When you run
pacman -U http://url/to/package.tar.xzit should also download the .sig file if there is one available.
Offline