Arch Linux

FranekW

Member

Registered: 2017-05-26

Posts: 8

Retrieving developper keys

I have downloaded Arch Linux ISO image, which I also tried to verify. I have imported all master keys from this website

https://www.archlinux.org/master-keys/

but when run the command

gpg2 --verify archlinux-2017.05.01-x86_64.iso.sig archlinux-2017.05.01-x86_64.iso

I have this output:

gpg: Signature made Mon 01 May 2017 08:12:35 BST
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: Can't check signature: No public key

I think I still have missing other developer keys. Is there a command I could use to retrieve all the keys? I don't have Arch Linux installed at the moment and I have no access to pacman. I would have to do it with gpg2 command.

Last edited by FranekW (2017-05-26 12:03:13)

loqs

Member

Registered: 2014-03-06

Posts: 19,114

Re: Retrieving developper keys

Category:Getting_and_installing_Arch

$ pacman-key -v archlinux-2017.05.01-x86_64.iso.sig
==> Checking archlinux-2017.05.01-x86_64.iso.sig...
gpg: assuming signed data in 'archlinux-2017.05.01-x86_64.iso'
gpg: Signature made Mon 01 May 2017 08:12:35 BST
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: Note: trustdb not writable
gpg: Good signature from "Pierre Schmitz <pierre@archlinux.de>" [full]
$ gpg2 --search-keys 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: data source: https://51.15.53.138:443
(1)	Pierre Schmitz <pierre@archlinux.de>
	  2048 bit RSA key 7F2D434B9741E8AC, created: 2011-04-10
Keys 1-1 of 1 for "4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC".  Enter number(s), N)ext, or Q)uit >

Edit:
Also welcome to the arch linux forums FranekW.
Edit:
Fixed link.  To clarify the code block contains two command,  pacman-key to show the iso is sisgned by the key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC which gpg2 already told you and gpg2 to search for that key

Last edited by loqs (2017-05-26 15:33:52)

FranekW

Member

Registered: 2017-05-26

Posts: 8

Re: Retrieving developper keys

Thanks loqs.

The link is broken, Also, I don't have access to pacman as have different distribution of linux installed. It is not Arch Linux.

Allan

Pacman

From: Brisbane, AU

Registered: 2007-06-09

Posts: 11,673

Website

Re: Retrieving developper keys

Receive the key the same way you would for any other project.  Using "gpg --recv-key".  Then think about how you might verifiy it.   It is well published by the developer and signed by all Arch master keys, so that should give you confidence.

---

PGP Key: F99FFE0FEAE999BD | I develop pacman - buy me a drink!

FranekW

Member

Registered: 2017-05-26

Posts: 8

Re: Retrieving developper keys

Hi Supreme Leader.

Would you mind providing more like a step by step explanation? "gpg --recv-ket" does nothing at all? If I had keys, I would probably know how to verify the file. Also, I've never had to retrieve any keys. Is there some option internet address I would provide when running gpg?

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Retrieving developper keys

It does nothing because you haven't told it which keys you want to import, so it successfully attempted to import zero keys.

If you haven't really used gpg much before now, it would be well worth your time to read the man page and learn how it works and all the various options it has.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)