Arch Linux User Repository

Although the gpg(1) man page says that option --keyserver is obsolete, the following command seems to work in order to fetch the SimpleX Chat team’s GPG key:

gpg --keyserver hkps://keys.openpgp.org --recv-keys 0xFB44AF81A45BDE327319797C85107E357D4A17FC

PS: I have uploaded the GPG key to Ubuntu’s keyserver, so from next package update it will no longer be included explicitly in this package.

@Juest 👍

i forgot to mention that i've resolved it by manually importing it with the keyserver, thanks for uploading it to the package/ubuntu keyserver so this is no longer needed @kseistrup !

Although the gpg(1) man page says that option --keyserver is obsolete, the following command seems to work in order to fetch the SimpleX Chat team’s GPG key:

gpg --keyserver hkps://keys.openpgp.org --recv-keys 0xFB44AF81A45BDE327319797C85107E357D4A17FC

PS: I have uploaded the GPG key to Ubuntu’s keyserver, so from next package update it will no longer be included explicitly in this package.

@Juest There are several ways to mitigate this:

1. Download the key from https://keys.openpgp.org/search?q=chat%40simplex.chat (URL mentioned in PKGBUILD), then import it with gpg --import < FB44AF81A45BDE327319797C85107E357D4A17FC.asc.
2. Temporarily add keyserver hkps://keys.openpgp.org to ~/.gnupg/gpg.conf, then fetch the key with gpg --recv-keys 0xFB44AF81A45BDE327319797C85107E357D4A17FC.

unfortunately the gpg key it asks to import is not found in ubuntu keyserver (which is the gpg default) but it's in openpgp apparently meaning the receiving keys step is failing out of the box

@taivlam It seems the SHA256 digests are indeed for the CLI binaries:

87b30d085e049e24e0d88bc70c1bd4685a2769e6de0ecbe6759b6311c39a86e0  v6.3.2/simplex-chat-ubuntu-20_04-x86-64
0677adaac345e3a0f7f0eee978856de23f963e5778c935b16b5069a658971728  v6.3.2/simplex-chat-ubuntu-22_04-x86-64

So I have included the _sha256sums{,.asc} files and created a sha256sums=(…) array. This way the _sha256sums file will be verified, and it will be up to the user to check that the SHA256 digest used in the PKGBUILD file is the same as the one found in the _sha256sum file.

@taivlam: Thanks for the suggestion. I welcome pull-requests/diffs to PKGBUILD.

Edit: the GPG verification is only for the Ubuntu tarball archives and not the DEB binaries.

Could you add GPG signature verification? The latest release v6.3.2 has released the GPG signatures (of the SHA256 checksums) and GPG public keys from both teams of SimpleX and Flux: https://github.com/simplex-chat/simplex-chat/releases/tag/v6.3.2

@Zame Thanks for notifying nme. It seems upstream has removed the [erratic] “-fdroid” from the download URL overnight. I have updated URL and checksums, and it works here. Please try again.