Package Details: librewolf-bin 133.0.3-1

Git Clone URL: https://aur.archlinux.org/librewolf-bin.git (read-only, click to copy)
Package Base: librewolf-bin
Description: Community-maintained fork of Firefox, focused on privacy, security and freedom.
Upstream URL: https://librewolf-community.gitlab.io/
Keywords: browser web
Licenses: GPL, MPL, LGPL
Conflicts: librewolf
Provides: librewolf
Submitter: lsf
Maintainer: lsf
Last Packager: lsf
Votes: 407
Popularity: 10.84
First Submitted: 2019-06-16 13:12 (UTC)
Last Updated: 2024-12-15 09:43 (UTC)

Dependencies (16)

Required by (28)

Sources (7)

Pinned Comments

lsf commented on 2021-11-10 12:14 (UTC) (edited on 2023-04-17 07:18 (UTC) by lsf)

https://wiki.archlinux.org/title/Arch_User_Repository#Acquire_a_PGP_public_key_if_needed

gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801

/edit: starting with 112.0-1, the binaries are signed with the maintainers shared key, so gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16 should do the trick instead. I've also signed the key with the previously used key, so you have at least some guarantee that it's not a malicious attack :)

Latest Comments

« First ‹ Previous 1 .. 12 13 14 15 16 17 18 19 Next › Last »

vglinden commented on 2021-02-15 17:43 (UTC)

Thanks lsf. It is working now :)

lsf commented on 2021-02-15 17:39 (UTC)

Hm, must have messed it up somewhere – could have sworn it hat worked before.

I've just pushed a new version anyway, so I hope now the checksums are correct again :)

vglinden commented on 2021-02-15 16:35 (UTC) (edited on 2021-02-15 16:48 (UTC) by vglinden)

Currently failing the sha256 checksum:

~% paru -S librewolf-bin 
:: Resolving dependencies... 
:: Calculating conflicts... 
:: Calculating inner conflicts... 
Repo (2) mozilla-common-1.4-6  startup-notification-0.12-7 
Aur (1) librewolf-bin-85.0.1-1 
:: Proceed to review? [Y/n]: 
:: Downloading PKGBUILDs... 
 PKGBUILDs up to date 
 nothing new to review 
:: Proceed with installation? [Y/n]: 
resolving dependencies... 
looking for conflicting packages... 
Packages (2) mozilla-common-1.4-6  startup-notification-0.12-7 
Total Installed Size:  0.06 MiB 
:: Proceed with installation? [Y/n] 
(2/2) checking keys in keyring 
(2/2) checking package integrity 
(2/2) loading package files 
(2/2) checking for file conflicts 
(2/2) checking available disk space 
:: Processing package changes... 
(1/2) installing mozilla-common 
relogin or source /etc/profile.d/mozilla-common.sh 
(2/2) installing startup-notification 
fetching devel info... 
==> Making package: librewolf-bin 85.0.1-1 (Mon 15 Feb 2021 05:14:06 PM CET) 
==> Retrieving sources... 
  -> Found librewolf-85.0.1-1-x86_64.pkg.tar.zst 
  -> Found librewolf-85.0.1-1-x86_64.pkg.tar.zst.sig 
==> Validating source_x86_64 files with sha256sums... 
    librewolf-85.0.1-1-x86_64.pkg.tar.zst ... FAILED 
    librewolf-85.0.1-1-x86_64.pkg.tar.zst.sig ... Skipped 
==> ERROR: One or more files did not pass the validity check! 
:: Packages failed to build: librewolf-bin-85.0.1-1

Trying to skip the checksums also did not work:

~% paru -S librewolf-bin --mflags "--skipchecksums" 
:: Resolving dependencies... 
:: Calculating conflicts... 
:: Calculating inner conflicts... 
Aur (1) librewolf-bin-85.0.1-1 
:: Proceed to review? [Y/n]: 
:: Downloading PKGBUILDs... 
 PKGBUILDs up to date 
 nothing new to review 
:: Proceed with installation? [Y/n]: 
fetching devel info... 
==> Making package: librewolf-bin 85.0.1-1 (Mon 15 Feb 2021 05:39:11 PM CET) 
==> Retrieving sources... 
  -> Found librewolf-85.0.1-1-x86_64.pkg.tar.zst 
  -> Found librewolf-85.0.1-1-x86_64.pkg.tar.zst.sig 
==> WARNING: Skipping verification of source file checksums. 
==> Verifying source file signatures with gpg... 
    librewolf-85.0.1-1-x86_64.pkg.tar.zst ... FAILED 
==> ERROR: One or more PGP signatures could not be verified! 
:: Packages failed to build: librewolf-bin-85.0.1-1

After trying to install it manually, I discover that it created to "pacman installables": librewolf-85.0.1-1-x86_64.pkg.tar.zst and librewolf-bin-85.0.1-1-x86_64.pkg.tar.zst.

  • librewolf-85.0.1-1-x86_64.pkg.tar.zst: failed at PGP key signature
  • librewolf-bin-85.0.1-1-x86_64.pkg.tar.zst: installs correctly

xavierbaez commented on 2021-01-22 13:15 (UTC)

Thanks lsf. It is working now :)

lsf commented on 2021-01-22 12:27 (UTC)

That's true – I've removed the second key for now, as mostly it's the first one that's used to sign the releases anyway.

xavierbaez commented on 2021-01-22 11:14 (UTC)

Hello lsf. I read your previous comment, imported the keys, it still will not work.

:: PGP keys need importing: -> 9D7008F8DFCD21508174954A3740FE9FC5772203, required by: librewolf-bin ==> Import? [Y/n] Y :: Importing keys with gpg... gpg: keyserver receive failed: No data problem importing keys

I think now the package expects both keys to be there, but only one is there

lsf commented on 2021-01-22 09:51 (UTC)

"Standard practices" apply for verifying the signatures:

The key is available on sks-keyservers.net or keys.gnupg.net (at least). You can manually download it and import it (eg: http://keys.gnupg.net/pks/lookup?op=get&search=0xD2845E1305D6E801), or get it with gpg: gpg --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801 or gpg --recv-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801. If you have set a different keyserver in your gnupg config, you can specify a keyserver directly by adding --keyserver url.to.some.keyserver, eg.: gpg --keyserver keys.gnupg.net --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801 or gpg --keyserver keys.gnupg.net --recv-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801.

If you absolutely do not care about signature verification, you can also skip it by adding --skippgpcheck when running makepkg, yay, paru etc.

freebench commented on 2021-01-22 07:06 (UTC)

==> ERROR: One or more PGP signatures could not be verified!

pfctl commented on 2021-01-20 07:09 (UTC)

FYI, error verifying source file signatures with gpg (keys not imported). Installation aborts:

==> Verifying source file signatures with gpg...
librewolf-84.0.2-1-x86_64.pkg.tar.zst ... FAILED (unknown public key 2954CC8585E27A3F)
==> ERROR: One or more PGP signatures could not be verified!

xavierbaez commented on 2021-01-19 06:35 (UTC)

:: PGP keys need importing: -> 031F7104E932F7BD7416E7F6D2845E1305D6E801, required by: librewolf-bin -> 9D7008F8DFCD21508174954A3740FE9FC5772203, required by: librewolf-bin ==> Import? [Y/n] Y :: Importing keys with gpg... gpg: keyserver receive failed: No name problem importing keys

« First ‹ Previous 1 .. 12 13 14 15 16 17 18 19 Next › Last »