Pacman4的数字签名与Master keys的导入

ReiFFEXzyx · 2012-01-20 18:21:17

pacman升级4.0后配置文件在/etc/pacman.conf.pacnew里
首先

# pacman-key --init

然后修改pacman设置

/etc/pacman.conf.pacnew

SigLevel的设置改为

SigLevel = Required DatabaseOptional TrustedOnly

GPG服务器设置不需要修改

/etc/pacman.d/gnupg/gpg.conf

修改后反而不能获取Master keys
至少我这边是这样的：
连接keyserver hkp://keys.gnupg.net还比较顺利
反而keyserver hkp://pgp.mit.edu:11371一直连不上，而且找不到Master keys

导入Master keys
现在只需要导入5个Master keys即可，开发者和信任用户的key都被这5个Master keys认证了，不再需要导入所有开发者和信任用户的key了

The idea behind these keys is that all developer and TU keys are signed by these keys and you only need to import and trust these keys in order to trust all the keys used to sign packages. These key fingerprints will be published in multiple places so that the user can have confidence in them

# pacman-key -r <keyid> <keyid> <keyid> <keyid> <keyid>

<keyid>和指纹可以在很多地方查询到，防止某一网站被黑，确保安全
wiki上给出的网址
https://www.archlinux.org/master-keys/
Allan这篇文章的末尾
http://allanmcrae.com/2011/12/pacman-pa … rch-linux/

本地认证
导入的key默认是"unknown"状态的，需要自己去sign，改trust级别为marginal

# pacman-key --edit-key <keyid>

gpg> lsign
...
 Primary key fingerprint: ...

会显示出该Master key的指纹，请在下列网站中仔细比对
https://www.archlinux.org/master-keys/
http://allanmcrae.com/2011/12/pacman-pa … rch-linux/
确认全部正确无误后再确认

...
Really sign? (y/N) y

更改trust级别为marginal

gpg> trust
...
Your decision? 3
gpg> q
Save changes? (y/N) y

覆盖配置
备份老配置

# cp /etc/pacman.conf /etc/pacman.conf.bak

覆盖老配置

# cp /etc/pacman.conf.pacnew /etc/pacman.conf

安装软件包过程中

# pacman -Syy
# pacman -Syu

会提示出错，软件的key未知，需要导入PGP key，例如：

error: firefox-adblock-plus: key "65C110C1EA433FC7" is unknown
:: Import PGP key EA433FC7, "Sergej Pupykin <ml@sergej.pp.ru>", created 2011-07-15? [Y/n]

PGP key在开发者列表和信任用户列表查询EA433FC7
https://www.archlinux.org/developers/
https://www.archlinux.org/trustedusers/
鼠标移动到0xEA433FC7这个链接上会显示"PGP key search for XXXX ..."40个16位数字的指纹
确保后4组16个数字与key "65C110C1EA433FC7"相同
然后才确认

参考链接
Wiki
https://wiki.archlinux.org/index.php/Pacman-key
Allan的文章
 http://allanmcrae.com/2011/12/pacman-pa ... rch-linux/

linlee · 2012-01-20 18:33:53

好。不过弄得好复杂呀。。

phoenixlzx · 2012-01-20 19:35:53

改成mit的是因为mit的key server是Archlinux开发者喜欢使用的Key server。后面加上端口号是因为有的ISP屏蔽了。

记得脚本里是直接写上从mit获取密钥了吧。

dryland718 · 2012-01-20 19:40:27

mit的我这里也连不上。

wakemecn · 2012-01-24 11:51:50

不做服务用SigLevel = Never得了

shoto · 2012-02-01 10:03:01

为什么我已经导入了全部key，但是还是无法正常安装，提示：

debug: returning error 33 from check_validity : invalid or corrupted package
error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.
debug: unregistering database 'local'
debug: freeing package cache for repository 'local'
debug: unregistering database 'core'
debug: freeing package cache for repository 'core'
debug: unregistering database 'extra'
debug: freeing package cache for repository 'extra'
debug: unregistering database 'community'
debug: freeing package cache for repository 'community'

该怎么办？

Arch Linux

#1 2012-01-20 18:21:17

Pacman4的数字签名与Master keys的导入

#2 2012-01-20 18:33:53

Re: Pacman4的数字签名与Master keys的导入

#3 2012-01-20 19:35:53

Re: Pacman4的数字签名与Master keys的导入

#4 2012-01-20 19:40:27

Re: Pacman4的数字签名与Master keys的导入

#5 2012-01-24 11:51:50

Re: Pacman4的数字签名与Master keys的导入

#6 2012-02-01 10:03:01

Re: Pacman4的数字签名与Master keys的导入

页脚