Arch Linux

gtf21

Member

Registered: 2020-06-28

Posts: 107

Website

Cannot verify the archlinux ISO with GPG -- "no public key"

I have used the exact command listed in the installation guide [1], but I still get the following error:

~/Downloads > gpg --keyserver-options auto-key-retrieve --verify archlinux-2020.06.01-x86_64.iso.sig
gpg: assuming signed data in 'archlinux-2020.06.01-x86_64.iso'
gpg: Signature made Mon 01 Jun 2020 10:53:53 BST
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: key 7F2D434B9741E8AC: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
gpg: Can't check signature: No public key

I've searched around but I haven't found anything except this thread [2] which mentioned the problem, but it was solved using the command above which it clearly isn't for me.

How can I verify the download?

[1]: https://wiki.archlinux.org/index.php/Installation_guide
[2]: https://bbs.archlinux.org/viewtopic.php?id=227962

loqs

Member

Registered: 2014-03-06

Posts: 17,373

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

Please see https://bbs.archlinux.org/viewtopic.php?id=255927

gtf21

Member

Registered: 2020-06-28

Posts: 107

Website

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

Please see https://bbs.archlinux.org/viewtopic.php?id=255927

I don't know how I didn't find that, but it worked. Shouldn't this solution form part of the ArchLinux wiki in that case? I suppose I'm wondering what is special about my case and the one of the OP in that thread which means it's not working for us.

loqs

Member

Registered: 2014-03-06

Posts: 17,373

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

If gpg is provided by gnupg then check if .gnupg/dirmngr.conf contains a keyserver setting,  older versions of gnupg had the setting in .gnupg/gpg.conf
If a default is not provided gnupg should be using the sks keyservers which do not allow keys without user ID that I know of.  Gnupg could be patched to use something else.

gtf21

Member

Registered: 2020-06-28

Posts: 107

Website

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

Those files don't exist. I'm on PopOS so I suppose it could have been modified to use something else. Thanks for the explanation though.

loqs

Member

Registered: 2014-03-06

Posts: 17,373

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

As PopOS is Debian based I am guessing it includes gnupg from Debian including [1]

[1] https://sources.debian.org/src/gnupg2/2 … rver.patch
Edit:
You could document the issue on https://wiki.archlinux.org/index.php/Ta … tion_guide

Last edited by loqs (2020-06-28 22:39:58)

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Cannot verify the archlinux ISO with GPG -- "no public key"

If you use e.g.

gpg --keyserver keyserver.ubuntu.com --recv-key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC

does it work?

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)