What's wrong with that package? I can't understand why some packages need it although there are already exists newer version of ncurses package in repositories.
What's the problem with pgp sign? It says, that i have already key 702353E0F7E48EDB and its not changed. But package sign not valid. It's a developer fault or mantainer?
Pinned Comments
WoefulDerelict commented on 2016-05-23 19:35 (UTC) (edited on 2018-08-18 20:22 (UTC) by WoefulDerelict)
This PKGBUILD verifies the authenticity of the source via PGP signatures which are not part of the Arch Linux keyring. In order to complete the process it is necessary to import the key(s) from the ‘validpgpkeys’ array into the user’s keyring before calling makepkg. There is a helpful article explaining this process by one of Arch Linux's developers located here: http://allanmcrae.com/2015/01/two-pgp-keyrings-for-package-management-in-arch-linux/
Instructions on importing keys from a keyserver and how to automate the retrieval process can be found in the Arch Linux wiki here: https://wiki.archlinux.org/index.php/GnuPG#Use_a_keyserver This article also contains helpful information describing the installation of GnuPG, its configuration and usage.
Execute the following to import keys using gpg:
gpg --recv-keys <KEYID - See 'validpgpkeys' array in PKGBUILD>
The PGP signature check can be skipped by passing --skippgpcheck to makepkg.
Consult the makepkg manual page for a full list of options. [https://www.archlinux.org/pacman/makepkg.8.html]