@MithicSpirit the same problem with makepkg
makepkg -si
==> Making package: librewolf-bin 94.0-1 (Wed 10 Nov 2021 08:03:23 AM AST)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Downloading librewolf-94.0-1-x86_64.pkg.tar.zst...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 75.3M 100 75.3M 0 0 6407k 0 0:00:12 0:00:12 --:--:-- 7999k
-> Downloading librewolf-94.0-1-x86_64.pkg.tar.zst.sig...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 119 100 119 0 0 420 0 --:--:-- --:--:-- --:--:-- 421
==> Validating source_x86_64 files with sha256sums...
librewolf-94.0-1-x86_64.pkg.tar.zst ... Passed
librewolf-94.0-1-x86_64.pkg.tar.zst.sig ... Skipped
==> Verifying source file signatures with gpg...
librewolf-94.0-1-x86_64.pkg.tar.zst ... FAILED (unknown public key 2954CC8585E27A3F)
==> ERROR: One or more PGP signatures could not be verified!
Pinned Comments
lsf commented on 2021-11-10 12:14 (UTC) (edited on 2023-04-17 07:18 (UTC) by lsf)
https://wiki.archlinux.org/title/Arch_User_Repository#Acquire_a_PGP_public_key_if_needed
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801
/edit: starting with 112.0-1, the binaries are signed with the maintainers shared key, so
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
should do the trick instead. I've also signed the key with the previously used key, so you have at least some guarantee that it's not a malicious attack :)