The archlinux-keyring project holds PGP packet material and tooling
(keyringctl
) to create the distribution keyring for Arch Linux.
The keyring is used by pacman to establish the web of trust for the packagers
of the distribution.
The PGP packets describing the main signing keys can be found below the keyring/main directory, while those of the packagers are located below the keyring/packager directory.
The following packages need to be installed to be able to create a PGP keyring from the provided data structure and to install it:
Build:
- make
- findutils
- pkgconf
- systemd
Runtime:
- python
- sequoia-sq >= 0.31.0
Optional:
- hopenpgp-tools (verify)
- git (ci)
Build all PGP artifacts (keyring, ownertrust, revoked files) to the build directory
./keyringctl build
Import a new packager key by deriving the username from the filename.
./keyringctl import <username>.asc
Alternatively import a file or directory and override the username
./keyringctl import --name <username> <file_or_directory...>
Updates to existing keys will automatically derive the username from the known fingerprint.
./keyringctl import <file_or_directory...>
Main key imports support the same options plus a mandatory --main
./keyringctl import --main <username>.asc
Export the whole keyring including main and packager to stdout
./keyringctl export
Limit to specific certs using an output file
./keyringctl export <username_or_fingerprint_or_directory...> --output <filename>
List all certificates in the keyring
./keyringctl list
Only show a specific main key
./keyringctl list --main <username_or_fingerprint...>
Inspect all certificates in the keyring
./keyringctl inspect
Only inspect a specific main key
./keyringctl inspect --main <username_or_fingerprint_or_directory...>
Verify certificates against modern expectations and assumptions
./keyringctl verify <username_or_fingerprint_or_directory...>
To install archlinux-keyring system-wide use the included Makefile
:
make install
Read our contributing guide to learn more about guidelines and how to provide fixes or improvements for the code base.
Releases of archlinux-keyring are exclusively created by keyring maintainers.
The tags are signed with one of the following legitimate keys:
Christian Hesse <[email protected]>
02FD 1C7A 934E 6145 4584 9F19 A623 4074 498E 9CEE
David Runge <[email protected]>
991F 6E3F 0765 CF62 9588 8586 139B 09DA 5BF0 D338
Johannes Löthberg <[email protected]>
5134 EF9E AF65 F95B 6BB1 608E 50FB 9B27 3A9D 0BB5
Leonidas Spyropoulos <[email protected]>
B4B7 5962 5D46 3343 0B74 8770 59E4 3E10 6B24 7368
Levente Polyak <[email protected]>
E240 B57E 2C46 30BA 768E 2F26 FC1B 547C 8D81 72C8
Morten Linderud <[email protected]>
C100 3466 7663 4E80 C940 FB9E 9C02 FF41 9FEC BE16
To verify a tag, first import the relevant PGP keys:
gpg --auto-key-locate wkd --search-keys <email-from-above>
Afterwards a tag can be verified from a clone of this repository. Please note that one must check the used key of the signature against the legitimate keys listed above:
git verify-tag <tag>
Archlinux-keyring is licensed under the terms of the GPL-3.0-or-later (see LICENSE).