Arch Linux User Repository

Install fails at PGP check because no key can be obtained. gpg --receive-keys 5A8ED9CFC0DB6C70 fails with no user ID as the de-facto new default keyserver keys.openpgp.org strips user IDs for privacy reasons if not instructed otherwise. Unfortunately that's the case for this key and I also could not find it on any other keyserver. This is a known problem with no solution in sight.

Only workaround for now: makepkg -s --skippgpcheck or yay -Sy hibiscus --mflags "--skippgpcheck"

Preferred solution: Instruct keys.openpgp.org to distribute user IDs with this key.

Edit: Issue resolved. In case of PGP problems use gpg --receive-keys 5A8ED9CFC0DB6C70

@dec: The key is still available, but because the old standard keyserver network hardcoded into gnupg has shut down recently, gpg can no longer find any keyservers to import keys from, unless you specify some in ~/.gnupg/dirmngr.conf. Alternatively, you could wait for gnupg 2.2.29 (currently in testing), which will introduce a new default.

@dec: thanks for reporting issues. However, please don't report issues with AUR helpers (in this case: yay), but try plain makepkg first. AUR helpers are not supported. Regarding the issue: have you tried commenting out the validpgps line? While the signature is supplied, the key seems to have vanished (?) from the key servers and can thus not be loaded anymore.

Hey guys, I tried to install hibiscus by yay -Sy hibiscus --noconfirm --sudoloop and got following back: :: PGP keys need importing: -> 7314FBDE7D38EE5610D291B65A8ED9CFC0DB6C70, required by: jameica hibiscus :: Importing keys with gpg... gpg: Empfangen vom Schlüsselserver fehlgeschlagen: Kein Name removing untracked AUR files from cache... Could be that the key is not valid any more?

@Ojaksch: thx, added. Pkgrel bump omitted since nothing changed.

Just tested: package is working with arch=aarch64

@Taijian: thanks for the reminder, I have removed it now. This was added before my time, atcually even in the initial import. I reckon it stems from the namcap run, which complains about libstdc++ and other libs not being covered by the dependencies. Namcap, however, is well known for false positives, as long as the software works we'll gladly ignore it. Sorry for not acting on this for so long!

Getting back to my question from last year: Could you please remove libstdc++5 from the depends array? It is really not necessary for this package to function.

Thank you!

Another small problem:

==> Verifying source file signatures with gpg...
    jameica-linux64-2.8.6.zip ... FAILED (unknown public key 5A8ED9CFC0DB6C70)
==> ERROR: One or more PGP signatures could not be verified!

I was wondering if there was a reason that this package pulls in libstdc++5? I tried to look for a reference on the intertubes telling me why this was needed and was unsucessful. On a whim, I tried removing it and running Hibiscus on top of the 'regular' libstdc++6 that is included in gcc-libs and could not find a difference.

So, did I overlook something or is this a superfluous dependency?