[SOLVED] PGP signature could not be verified!

Question

I am trying to install password safe from the AUR.
I have downloaded and un-tarred the tar.gz file but when I execute makepkg -s I get the following error:
$ makepkg -s
==> Making package: passwordsafe 0.94.1BETA-1 (Mon Dec 29 21:41:00 PST 2014)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found pwsafe-0.94.1BETA-src.tgz
-> Found pwsafe-0.94.1BETA-src.tgz.sig
==> Validating source files with md5sums...
pwsafe-0.94.1BETA-src.tgz ... Passed
pwsafe-0.94.1BETA-src.tgz.sig ... Passed
==> Verifying source file signatures with gpg...
pwsafe-0.94.1BETA-src.tgz ... FAILED (unknown public key 919464515CCF8BB3)
Following the instructions on the "Package Signing" wiki, I:
$ sudo pacman -S haveged
$ sudo systemctl start haveged.service
$ sudo pacman-key --init
$ sudo pacman-key --populate archlinux
$ sudo pacman-key --add pwsafe-0.94.1BETA-src.tgz.sig
[sudo] password for xxxxx:
==> Updating trust database...
gpg: next trustdb check due at 2016-01-22
makepkg -s still fails at this point.
The next steps on the wiki call for:
1. verifying the fingerprint with: $ pacman-key -f keyid, and
2. locally signing the imported key with: # pacman-key --lsign-key keyid
How do I determine the "keyid"?
If I use the 'public key' returned in the error message above, I get:
$ pacman-key -f 919464515CCF8BB3
gpg: Note: trustdb not writable
gpg: error reading key: No public key
==> ERROR: The fingerprint of a specified key could not be determined.
And if I use the name of the file I downloaded with the tar, I get:
$ pacman-key -f pwsafe-0.94.1BETA-src.tgz.sig
gpg: Note: trustdb not writable
gpg: error reading key: No public key
==> ERROR: The fingerprint of a specified key could not be determined.
I even tried un-tarring the signature... but that didn't work either.
$ tar xzvf pwsafe-0.94.1BETA-src.tgz.sig
gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
I also searched through pacman's keyring directly with:
$ gpg --homedir /etc/pacman.d/gnupg --list-keys
but I didn't see the packager's name or email address anywhere.
A nudge in the right direction would be greatly appreciated.
Cheers,
Last edited by sirdle (2014-12-31 01:05:32)

Answer 1

Thank you to everyone who replied!
It has taken me a while to read all the links and try to understand them.
My main problem was that I was mixing up package signing (via pacman) with package signing (via makepkg). The two are related, but separate: they both use gpg, they both use keys that can be downloaded from key servers, they both use keys that can be locally signed, they both use key-rings... but the key-rings they use are different, and process they use to install and validate those keys is also different. (Correct me if I'm wrong.)
From the Wiki
The signature checking implemented in makepkg does not use pacman's keyring.
In my case, I'm installing from the AUR. The error I received:
FAILED (unknown public key 919464515CCF8BB3)
was because makepkg could not find the supplied key in my personal key-ring.
All I needed to do was:
1. Download the key.
2. Add it to my personal key ring.
3. Trust it.
Alternatively, I could build the package by skipping the check.
Download the Key
1. Download from the MIT key server. Enter the keyid as a 16-digit hex number, e.g., 0x919464515ccf8bb3. Right-click on the result and save to the desktop [see  Roken's post] above. Or,
2. Try the command line per jasonwryan's post above. (This number does not need to start with 0x.)
I tried both of these methods to verify that they work. They do.
Add the key to my personal keyring
With jasonwryan's method, the key is added as part of the command. With Roken's method an additional command is needed:
gpg --import /path/to/saved/keyfile
If I try makepkg -s at this point I still get an error... but the error is different. It is now:
FAILED (the public key A703C1328EABC7B201753BA3919464515CCF8BB3 is not trusted)
which brings us to the third step.
Trust It
$ gpg --list-keys # to get the correct keyid
$ gpg -edit-key keyid # from the previous command
gpg> trust
At this point, gpg asks the user how much he trusts this key. If you're like stevenhoneyman you might say, "Er... not very much" and opt for building without trust.
Or you can grant a lot of trust in order to create the package and then revoke the trust later (but I'm guessing this will cause problems when the package needs to be updated).
A level of 5 "Ultimate Trust" was required to build this package.
Thanks to everybody who helped me out with this. Definitely a learning experience!
Last edited by sirdle (2014-12-31 01:21:53)