Arch Linux

t0w3rh0u53

Member

Registered: 2018-04-11

Posts: 11

GPG: Can't check signature: No public key

I can't verify my downloaded Arch image, I keep getting this error message:

$ gpg --keyserver-options auto-key-retrieve --verify archlinux-2018.04.01-x86_64.iso.sig
gpg: assuming signed data in 'archlinux-2018.04.01-x86_64.iso'
gpg: Signature made Sun Apr  1 07:07:15 2018 CEST
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: Can't check signature: No public key

I googled and searched in the wiki, but the command which the wiki provides doesn't work for me as you can see.

I stumbled on this topic, but it seems that the provided code from the wiki does work for them:
https://bbs.archlinux.org/viewtopic.php?id=227962

What can I do to fix this? It seems that I am missing a public key, but I cannot figure out where to get it.

EDIT:
I tried this on my Mac and Ubuntu system, but no luck so far.

Last edited by t0w3rh0u53 (2018-04-13 11:40:34)

t0w3rh0u53

Member

Registered: 2018-04-11

Posts: 11

Re: GPG: Can't check signature: No public key

A colleague just helped me out. It seems that I forgot to setup my GPG for the first time. It works now!!!!
So for those who need help with this as well, checkout this url

Last edited by t0w3rh0u53 (2018-04-13 12:18:28)

loqs

Member

Registered: 2014-03-06

Posts: 19,016

Re: GPG: Can't check signature: No public key

$ ls .gnupg
ls: cannot access '.gnupg': No such file or directory
$ gpg --keyserver-options auto-key-retrieve --verify archlinux-2018.04.01-x86_64.iso.sig
gpg: directory '/home/testuser/.gnupg' created
gpg: keybox '/home/testuser/.gnupg/pubring.kbx' created
gpg: assuming signed data in 'archlinux-2018.04.01-x86_64.iso'
gpg: Signature made Sun 01 Apr 2018 05:07:15 UTC
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: key 7F2D434B9741E8AC: 29 signatures not checked due to missing keys
gpg: /home/testuser/.gnupg/trustdb.gpg: trustdb created
gpg: key 7F2D434B9741E8AC: public key "Pierre Schmitz <pierre@archlinux.de>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Good signature from "Pierre Schmitz <pierre@archlinux.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4AA4 767B BC9C 4B1D 18AE  28B7 7F2D 434B 9741 E8AC

This was using gnupg 2.2.5-2 as provided by arch perhaps the issue is version specific.

Last edited by loqs (2018-04-13 17:48:20)

keishisava

Member

Registered: 2021-03-10

Posts: 1

Re: GPG: Can't check signature: No public key

I could not auto retrieve the public key, so in the end I fetched it manually:

gpg --fetch-key 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x4aa4767bbc9c4b1d18ae28b77f2d434b9741e8ac'

and then checked the signature with

gpg  --verify archlinux-*.iso.sig

WorMzy

Administrator

From: Scotland

Registered: 2010-06-16

Posts: 13,638

Website

Re: GPG: Can't check signature: No public key

Good for you. However, please don't bump old topics.

Closing.

---

Sakura:-
Mobo: MSI MAG X570S TORPEDO MAX // Processor: AMD Ryzen 9 5950X @4.9GHz // GFX: AMD Radeon RX 5700 XT // RAM: 32GB (4x 8GB) Corsair DDR4 (@ 3000MHz) // Storage: 1x 3TB HDD, 6x 1TB SSD, 2x 120GB SSD, 1x 275GB M2 SSD

Making lemonade from lemons since 2015.