@lsf it seemed that the default gpg --search can't identify the key:
gpg --search-keys 2954CC8585E27A3F
gpg: data source: https://keys.openpgp.org:443
(1) 256 bit EDDSA key D2845E1305D6E801, created: 2020-03-14
Keys 1-1 of 1 for "2954CC8585E27A3F". Enter number(s), N)ext, or Q)uit > 1
gpg: key D2845E1305D6E801: no user ID
gpg: Total number processed: 1
However, I successfully install librewolf after using gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 2954CC8585E27A3F
Thank you very much. :)
Pinned Comments
lsf commented on 2021-11-10 12:14 (UTC) (edited on 2026-05-07 09:38 (UTC) by lsf)
https://wiki.archlinux.org/title/Arch_User_Repository#Acquire_a_PGP_public_key_if_needed
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801/edit: starting with 112.0-1, the binaries are signed with the maintainers shared key, so
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16should do the trick instead. I've also signed the key with the previously used key, so you have at least some guarantee that it's not a malicious attack :)/edit: (2026-05-07): The upstream signing sub-key was rotated, and the
.tar.xztarballs will now be signed with a new subkey. The main key id (0x662E3CDD6FE329002D0CA5BB40339DD82B12EF16) remains unchanged though, so should you get an error during signature verification about a missing (sub)key, all that's required would be to refresh the key(s) viagpg --refresh-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16.