Arch Linux

dynosaw

Member

Registered: 2018-07-12

Posts: 54

Does pacman automatically update the key signatures ??

Dear people,
I understand that the validity of a developer's key-signature
in the trust database expires with the passage of time.
Signatures can be manually updated with
   pacman-key --refresh-keys.
But is that necessary??
Does pacman update almost-expired signatures in the course
of regular updates??

Thanks in advance for a YES/NO answer.
Dynosaw 
--

loqs

Member

Registered: 2014-03-06

Posts: 19,103

Re: Does pacman automatically update the key signatures ??

No.  As you only wanted a yes no answer without explanation.
Edit:
Explanation anyway when the expiration time is reached the key will no longer be accepted.
If a developer has a new key and it has been added to the archlinux-keyring package it will be installed on the next update of that package.
If a package is signed by a key that is not in the keyring the key will be downloaded from a keyserver and used provided the key is signed by three master keys.

Last edited by loqs (2019-03-02 13:29:25)

dynosaw

Member

Registered: 2018-07-12

Posts: 54

Re: Does pacman automatically update the key signatures ??

Excellent answer. Thank you.
Dynosaw.

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Does pacman automatically update the key signatures ??

Arch Linux has a distribution policy to ensure that keys with an expiry time, which has been reached, need to be updated in the archlinux-keyring package and deployed to all users in that manner. Usually this happens automatically as each archlinux-keyring release contains the latest version of all official packaging keys, and the keyring usually gets updated at least once every couple of months due to new members of the packaging team.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

dynosaw

Member

Registered: 2018-07-12

Posts: 54

Re: Does pacman automatically update the key signatures ??

Again thanks.
The reason for asking was that my Arch installation lay dormant
for a few weeks. Then I found that I couldn't update it because
some developers' keys had exired. I solved the problem, but the
question remained. Now it is absolutely clear.

Dynosaw
--