You are not logged in.
At this link...
https://archlinux.org/download/
...it says:
To verify the PGP signature using Sequoia, first download the release signing key from WKD:
$ sq network wkd fetch pierre@archlinux.org -o release-key.pgp
When I do that, it fails with the following error message:
$ sq network wkd fetch pierre@archlinux.org -o release-key.pgp
error: Found argument 'network' which wasn't expected, or isn't valid in this context
USAGE:
    sq [FLAGS] [OPTIONS] <SUBCOMMAND>
For more information try --helpWhat am I doing wrong?
Last edited by erik_123 (2024-12-27 22:03:00)
Offline
That doesn't look right to me (from reading the documentation).
I don't see 'fetch' anywhere, and I'm not sure what the '-o' option is supposed to do.
How about...
sq network wkd search pierre@archlinux.org --output release-key.pgp
sq verify --signer-file release-key.pgp --signature-file archlinux-2024.12.01-x86_64.iso.sig archlinux-2024.12.01-x86_64.iso???
Cheers,
See also:
      search a certificate
      sq verify
man sq-network-wkd
man sq-verifyLast edited by dakota (2024-12-30 04:10:16)
"Before Enlightenment chop wood, carry water. After Enlightenment chop wood, carry water." -- Zen proverb
Offline

Since sequoia-sq 0.33 the command was changed to
sq network wkd fetch
https://bbs.archlinux.org/viewtopic.php?id=293379
Then later, since sequoia-sq 0.39 the command was changed again to
sq network wkd search
https://gitlab.com/sequoia-pgp/sequoia- … b907ef9197
Feel free to send a pull requests on https://github.com/archlinux/archweb
Offline
I had to use fetch to get the signing key, but the next command, "sq verify --signer-file release-key.pgp --signature-file archlinux-2025.05.01-x86_64.iso.sig archlinux-2025.05.01-x86_64.iso," is giving me issues. When executed, I'm getting "unexpected argument '--signature-file' found"
Does anyone know if the --signature-file option was changed? I can't seem to find much on it, but it could be because I'm using the wrong terms
EDIT: Ended up using the GnuPG alternative and got it going
Last edited by billymaysv2 (2025-05-23 04:27:17)
Offline
Hi, I encountered the same issue, but found the solution and wanted to share for any other confused newcomer. The "--signature-file" argument is apparently deprecated, even though it is still present in Sequoia's documentation. The new argument is "--detached", so one should give the following command:
sq verify --signer-file release-key.pgp --detached archlinux-2025.05.01-x86_64.iso.sig archlinux-2025.05.01-x86_64.iso
Last edited by bergoalbin (2025-10-22 19:06:19)
Offline
just yet another one in my "nah, won't use pgp after learned about it" jar
unfortunately the community is so into it even tools like git pretty much build around gnupg specific way how to sign commits
pgp is such cancer - although it's still just rsa under the hood anyway
Offline
Bit off topic but you can use torrent file and then you have signature check "for free", included within.
Offline