Fixed up the Netbeans PKGBUILD, just need some advice

matty_r · 2023-11-02 00:45:16

Hi all,

I've managed to fix the Netbeans PKGBUILD (My fork is here https://gitlab.archlinux.org/matty_r/netbeans), I just need a way to import the official PGP keys provided in the Keys file. The original PKGBUILD has a validpgpkeys array, but we need to actually import the keys.

Can anybody help out on how I can import the keys, prior to validation? I've added a check() function which just does `gpg --import KEYS` but that only takes into affect after it attempts to validate the packages.

This is a follow up from https://bbs.archlinux.org/viewtopic.php?id=289960

Quick edit: Once that is done I need to figure out how I get in touch with the current maintainer for the Netbeans package to raise a merge request.

Last edited by matty_r (2023-11-02 00:46:34)

Allan · 2023-11-02 03:34:05

Importing the keys is not done in the PKGBUILD - they are provided alongside the PKGBUILD just for easy access. Just do a gpg --import before running makepkg.

Note that the check() function you provided is run after all source verification is already complete...

matty_r · 2023-11-02 04:38:26

Allan wrote:

Importing the keys is not done in the PKGBUILD - they are provided alongside the PKGBUILD just for easy access. Just do a gpg --import before running makepkg.
Note that the check() function you provided is run after all source verification is already complete...

That makes total sense, but we don't expect people to run gpg --import prior to someone installing a package? I might be conflating the stages here - does pacman do that automatically but running makepkg doesn't?

Allan · 2023-11-02 06:35:39

There are two different PGP verifications going on here:

1) the source files provided by the software developer are being verified by makepkg. This uses the keys beside the PKGBUILD
2) the verification of packages by pacman. These packages are signed with an Arch packager's key, which are found in the archlinux-keyring package. Note this only happens for repo packages, not packages you have built locally.

matty_r · 2023-11-02 07:02:29

Allan wrote:

There are two different PGP verifications going on here:
1) the source files provided by the software developer are being verified by makepkg. This uses the keys beside the PKGBUILD
2) the verification of packages by pacman. These packages are signed with an Arch packager's key, which are found in the archlinux-keyring package. Note this only happens for repo packages, not packages you have built locally.

Ok, so I think my fork should be good to go then. I just removed the check function.

Arch Linux

#1 2023-11-02 00:45:16

Fixed up the Netbeans PKGBUILD, just need some advice

#2 2023-11-02 03:34:05

Re: Fixed up the Netbeans PKGBUILD, just need some advice

#3 2023-11-02 04:38:26

Re: Fixed up the Netbeans PKGBUILD, just need some advice

#4 2023-11-02 06:35:39

Re: Fixed up the Netbeans PKGBUILD, just need some advice

#5 2023-11-02 07:02:29

Re: Fixed up the Netbeans PKGBUILD, just need some advice

Board footer