@ParadiseofMagic That's cool, but the maintainer of this package has been afk for a while now. It's annoying to me to have to see that this package was flagged out of date by some dumbass and the maintainer isn't clearing the flag. This has been happening for about a week now.
Furthermore, I'm starting to suspect that librewolf is actually a trash, insecure fork. At the time of this writing it's now been about 9 days since firefox 145 came out. That release contains a number of security fixes. I haven't looked into the implications of these security issues, but it's a standard and super vital practice to stay up-to-date with browser updates for the sake of security.
Given that librewolf is not even recommended by https://www.privacyguides.org/en/desktop-browsers/, I suspect that we're a like minded group of dummies who are using an inferior and insecure fork. I'm posting this here in the hopes that somebody will prove me wrong.
Pinned Comments
lsf commented on 2021-11-10 12:14 (UTC) (edited on 2026-05-07 09:38 (UTC) by lsf)
https://wiki.archlinux.org/title/Arch_User_Repository#Acquire_a_PGP_public_key_if_needed
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 031F7104E932F7BD7416E7F6D2845E1305D6E801/edit: starting with 112.0-1, the binaries are signed with the maintainers shared key, so
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16should do the trick instead. I've also signed the key with the previously used key, so you have at least some guarantee that it's not a malicious attack :)/edit: (2026-05-07): The upstream signing sub-key was rotated, and the
.tar.xztarballs will now be signed with a new subkey. The main key id (0x662E3CDD6FE329002D0CA5BB40339DD82B12EF16) remains unchanged though, so should you get an error during signature verification about a missing (sub)key, all that's required would be to refresh the key(s) viagpg --refresh-keys 662E3CDD6FE329002D0CA5BB40339DD82B12EF16.