| Git Clone URL: | https://aur.archlinux.org/aurman.git (read-only, click to copy) |
|---|---|
| Package Base: | aurman |
| Description: | AUR helper with almost pacman syntax |
| Upstream URL: | https://github.com/polygamma/aurman |
| Licenses: | MIT |
| Submitter: | polygamma |
| Maintainer: | polygamma |
| Last Packager: | polygamma |
| Votes: | 199 |
| Popularity: | 0.23 |
| First Submitted: | 2018-03-20 21:31 (UTC) |
| Last Updated: | 2023-05-14 20:28 (UTC) |
Hi, with the latest update, it said
"PGP Key 4C3CE98F9579981C21CA1EC3465022E743D71E39 found in PKGBUILD of aurman and is not known yet. Do you want to import the key?"
I know I can probably trust this, but how can I verify myself that I can trust this?
(seeing all the comments here I hope this is the right place to ask)
@Eschwartz - see: https://aur.archlinux.org/cgit/aur.git/commit/?h=aurman&id=2dc46d3f2ff2
Hey, now that pacman 5.1 with support for signed VCS sources should be broadly available and given that you use PGP-signing on the git release tags (as of the latest), could you please add ?signed to the git source and your validpgpkeys fingerprint.
I'd appreciate that for the -git version as well, but I'm not sure how feasible that is since the current HEAD commit is not signed. :/ It would require committing to always ensuring the current HEAD commit is signed.
This would address and exceed the requests mentioned a couple times before in the comments here, about doing checksum verification.
(Quick note to everyone in general: the checksums are meant to ensure download integrity, but git repositories already guarantee this, it's built into the git protocol. Verifying the code authorship is a different issue entirely, which checksums does not address but PGP does...)
I like the fact this is in python with a readable code, very few dependencies, and actively maintained. good job.
@polygamma: Thank you for your hard work.
@Camponotus: https://github.com/falconindy/expac/pull/35
Thank you for the great aurman package! Why did you change the expac dependencies from expac to the AUR package expac-git?
Pinned Comments