[Solved] makepkg warning about unknown key

Question

Hello,
when compiling cower 7-1 a strange warning was given by makepkg.
==> Verifying source file signatures with gpg...
cower-7.tar.gz ... FAILED (unknown public key 1EB2638FF56C0C53)
==> WARNING: Warnings have occurred while verifying the signatures.
Please make sure you really trust them.
EDIT: The warning is shown due to signature files attached to the package. It can be solved for packages made by archlinux devs:
- run as user
"# gpg --list-keys"
  in order to create a gpg database for your current user, if it is not present already.
- add
"keyring /etc/pacman.d/gnupg/pubring.gpg"
  to the end of
~/.gnupg/gpg.conf.
WorMzy wrote:Alternatively, run makepkg with --skippgpcheck to stop makepkg trying to validate the file with it's .sig file.
Last edited by teateawhy (2012-11-06 16:22:30)

Answer 1

teateawhy wrote:The error will occur only for aur Packagebuilds created by arch linux developers, because of present keys.
Mmm, not quite. You'll have the same problem with any PKGBUILD that has an unknown signature, not just AUR packages by the Arch devs.
The warning (it's not really an error) is coming up because the source tarball's signature is included in the source array:
source=("https://github.com/downloads/falconindy/$pkgname/$pkgname-$pkgver.tar.gz"{,.sig})
That's a lazyman's way of writing:
source=("https://github.com/downloads/falconindy/$pkgname/$pkgname-$pkgver.tar.gz"
"https://github.com/downloads/falconindy/$pkgname/$pkgname-$pkgver.tar.gz.sig")
makepkg is smart enough to know that .sig files are used to check the authenticy and integrity of it's namesake file, and so automagically runs a gpg check for you. At this point, since you're running makepkg as yourself, gpg is run as you, and uses your ~/.gnupg/pubring.gpg, which I assume doesn't have Dave's key in it. ('gpg --list-keys' would no doubt confirm that).
A quick fix for Arch dev packages would be to add "keyring /etc/pacman.d/gnupg/pubring.gpg" to the end of ~/.gnupg/gpg.conf.
Alternatively, run makepkg with --skippgpcheck to stop makepkg trying to validate the file with it's .sig file.