Arch Linux User Repository

@Firechris: thanks fixed. Please refrain from pasting diffs though, especially for a trivial change as a checksum update. For security reasons I will never copy/paste and only implement what I understand - so providing an explanation is preferable over a diff almost always. Thank you for the attention on this matter…

Somehow the checksum has changed:

diff --git a/.SRCINFO b/.SRCINFO
index 12350e7..78e98cc 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -17,7 +17,7 @@ pkgbase = hibiscus
        source = https://www.willuhn.de/products/hibiscus/releases/2.12/hibiscus-2.12.2.zip.asc
        source = hibiscus.desktop
        validpgpkeys = 7314FBDE7D38EE5610D291B65A8ED9CFC0DB6C70
-       sha512sums = 4b2d766be95f405f221fdf3aad1d4a4e09d6e5ae1c5c7aa2af6b566f6a1a7f08893bf7f81e93d9115c2bd232377db0370f5192efc07b92a2bb15bc42162e567f
+       sha512sums = 452621a3a5942678a8e15da836113c72a5ba1c9967669e4b675322b0bf31ba106fd0cfda811e95f4d96b024fde7208dc35ac72dd1664729fd3cb8277d7c1b616
        sha512sums = SKIP
        sha512sums = ceea9cc5cf438893b2f5dfe46f46840448353f35719216ccca0b8dd12369d4e3c91d393c7c8b5b842a64537c61864ce8ca48e1895bb3f41c5083794399a21925

diff --git a/PKGBUILD b/PKGBUILD
index 3c865dd..cc7a2e1 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -16,7 +16,7 @@ source=("https://willuhn.de/products/hibiscus/releases/$_pkgver/hibiscus-${pkgver}.zip"
"https://www.willuhn.de/products/hibiscus/releases/$_pkgver/hibiscus-${pkgver}.zip.asc"
"hibiscus.desktop")
 validpgpkeys=("7314FBDE7D38EE5610D291B65A8ED9CFC0DB6C70") # Olaf Willuhn <info@willuhn.de>
-sha512sums=('4b2d766be95f405f221fdf3aad1d4a4e09d6e5ae1c5c7aa2af6b566f6a1a7f08893bf7f81e93d9115c2bd232377db0370f5192efc07b92a2bb15bc42162e567f'
+sha512sums=('452621a3a5942678a8e15da836113c72a5ba1c9967669e4b675322b0bf31ba106fd0cfda811e95f4d96b024fde7208dc35ac72dd1664729fd3cb8277d7c1b616'
             'SKIP'
             'ceea9cc5cf438893b2f5dfe46f46840448353f35719216ccca0b8dd12369d4e3c91d393c7c8b5b842a64537c61864ce8ca48e1895bb3f41c5083794399a21925')

You need to make the license identifier SPDX compliant:

hibiscus E: GPL2 is not a valid SPDX license identifier. See https://spdx.org/licenses/ for valid identifiers, or prefix the identifier with 'LicenseRef-', if it is custom.

Also, there might be lib32-related issues:

hibiscus E: Dependency lib32-gcc-libs detected and not included (libraries ['usr/lib32/libstdc++.so.6', 'usr/lib32/libgcc_s.so.1'] needed in files ['opt/jameica/plugins/hibiscus/lib/libhbci4java-card-linux-32.so', 'opt/jameica/plugins/hibiscus/lib/libhbci4java-sizrdh-linux-gcc3.so'])
hibiscus E: Dependency lib32-glibc detected and not included (libraries ['usr/lib32/libdl.so.2', 'usr/lib32/libc.so.6', 'usr/lib32/libm.so.6', 'usr/lib32/libpthread.so.0'] needed in files ['opt/jameica/plugins/hibiscus/lib/libct.so', 'opt/jameica/plugins/hibiscus/lib/libhbci4java-sizrdh-linux-gcc2.so', 'opt/jameica/plugins/hibiscus/lib/libhbci4java-card-linux-32.so', 'opt/jameica/plugins/hibiscus/lib/libtowitoko-2.0.7.so', 'opt/jameica/plugins/hibiscus/lib/libhbci4java-sizrdh-linux-gcc3.so'])

Regards and thanks for the package!

Install fails at PGP check because no key can be obtained. gpg --receive-keys 5A8ED9CFC0DB6C70 fails with no user ID as the de-facto new default keyserver keys.openpgp.org strips user IDs for privacy reasons if not instructed otherwise. Unfortunately that's the case for this key and I also could not find it on any other keyserver. This is a known problem with no solution in sight.

Only workaround for now: makepkg -s --skippgpcheck or yay -Sy hibiscus --mflags "--skippgpcheck"

Preferred solution: Instruct keys.openpgp.org to distribute user IDs with this key.

Edit: Issue resolved. In case of PGP problems use gpg --receive-keys 5A8ED9CFC0DB6C70

@dec: The key is still available, but because the old standard keyserver network hardcoded into gnupg has shut down recently, gpg can no longer find any keyservers to import keys from, unless you specify some in ~/.gnupg/dirmngr.conf. Alternatively, you could wait for gnupg 2.2.29 (currently in testing), which will introduce a new default.

@dec: thanks for reporting issues. However, please don't report issues with AUR helpers (in this case: yay), but try plain makepkg first. AUR helpers are not supported. Regarding the issue: have you tried commenting out the validpgps line? While the signature is supplied, the key seems to have vanished (?) from the key servers and can thus not be loaded anymore.

Hey guys, I tried to install hibiscus by yay -Sy hibiscus --noconfirm --sudoloop and got following back: :: PGP keys need importing: -> 7314FBDE7D38EE5610D291B65A8ED9CFC0DB6C70, required by: jameica hibiscus :: Importing keys with gpg... gpg: Empfangen vom Schlüsselserver fehlgeschlagen: Kein Name removing untracked AUR files from cache... Could be that the key is not valid any more?

@Ojaksch: thx, added. Pkgrel bump omitted since nothing changed.

Just tested: package is working with arch=aarch64

@Taijian: thanks for the reminder, I have removed it now. This was added before my time, atcually even in the initial import. I reckon it stems from the namcap run, which complains about libstdc++ and other libs not being covered by the dependencies. Namcap, however, is well known for false positives, as long as the software works we'll gladly ignore it. Sorry for not acting on this for so long!