Arch Linux User Repository

Upstream doesn't sign most commits anymore, so GPG signature check is disabled. They still sign every tag. Packages in the official repos package tags. You can check signatures with the following commands:

$ git log --format=raw --show-signature main
$ git tag -v $(git tag)

edit: found my problem the key server it could be useful for other people.

The default port is an high port and your ISP might filter it out!

use :80 in the ubuntu one and it should work:

pal ➜  ~  gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4CDE8575E547BF835FE15807A31B6BD72486CFD6
gpg: key A31B6BD72486CFD6: public key "Josh Boyer <jwboyer@fedoraproject.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1

https://wiki.archlinux.org/title/Arch_User_Repository#ERROR%3A_One_or_more_PGP_signatures_could_not_be_verified%21%3B_what_should_I_do%3F

https://wiki.archlinux.org/title/PKGBUILD#validpgpkeys

https://wiki.archlinux.org/title/Makepkg#Signature_checking

https://wiki.archlinux.org/title/Arch_User_Repository#What_is_the_difference_between_foo_and_foo-git_packages%3F

Failing to build in a clean chroot with this error:

==> Starting package_linux-firmware-git()...
install -d /build/linux-firmware-git/pkg/linux-firmware-git/usr/lib/firmware
./copy-firmware.sh --zstd /build/linux-firmware-git/pkg/linux-firmware-git/usr/lib/firmware
./copy-firmware.sh: line 69: ./check_whence.py: cannot execute: required file not found
ERROR: check_whence.py has detected errors.
make: *** [Makefile:49: install-zst] Error 1

Anyone else?

Upstream doesn't sign most commits anymore, so GPG signature check is disabled. They still sign every tag. Packages in the official repos package tags. You can check signatures with the following commands:

$ git log --format=raw --show-signature main
$ git tag -v $(git tag)

seted as obsolete : missing dependancy : rdfind Need to find a way to avoid the use of --skippgpcheck

just a quick question is the latest gsp stuff downloadable if I use this like this stuff https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=f4a3c72e5c413a601d1e21f9606f1c94a610d05d

Looks like the problem with signatures is that the main branch is not being signed (anymore - was it ever? I don't know). Only tags are signed

Oh, well... https://www.spinics.net/lists/kernel/msg4521808.html

Oh, that explains it. Thanks for the info. I disabled the check for now and went with the newest version. Of course, as you said, at my own risk. I am also not aware on how to handle SSH signatures in PKGBUILDs, sorry :/

For some reason, some commits are now signed with SSH signature instead of PGP signature. I don't know how to make makepkg work with that. The last commit signed with PGP is c801b3b807d249bc24ab826e2754191f5f58cd1b, so use that one, or skip signature check AT YOUR OWN RISK.