Checksums don't add security, that's why they're the "integrity check", not the "security check". Do you know how many [core] packages don't have PGP signatures available at all? Those are used on far more devices.
Granted, using PGP when available is always nice. But I don't see you screeching at the non-dkms package maintainer to fix his packages...
Edit: to clarify, I even like strong integrity checks myself, because they're definitely better than nothing and it can only help. But you're going about this totally the wrong way and you should also consider the old saying about people who live in glass houses.
Pinned Comments
kstolp commented on 2023-09-29 00:34 (UTC)
When requesting changes, please include detailed reasoning for the change.
kstolp commented on 2023-01-07 09:31 (UTC)
If you receive this error when trying to build, it is because you have not imported the GPG keys used for verification.
You have two options:
1) Import the two keys into your keyring. ArchWiki article. You can find the key IDs in the PKGBUILD file, in the
validpgpkeys
array. (recommended)2) Alternatively, you can skip this verification by passing the
--skippgpcheck
argument tomakepkg
when building. (not recommended)