Question on wiki: How-to verify GPG key of official .ISO images

[stargazer]

Reading the Manjaro wiki documentation, option 3.2 (shown below), I get errors for the keyserver not found:

Errors:

gpg: error searching keyserver: No name
gpg: keyserver search failed: No name

Should the Manjaro wiki documentation continue to use Phil’s key or rather the Manjaro Build Server <build@manjaro.org> key?

/usr/bin/gpg --keyserver hkps://keys.openpgp.org --search-keys 279E7CF5D8D56EC8

snippet of “How-to verify GPG key of official .ISO images”

If you do not trust GitLab, import Philip Müller’s GPG key to your system (afterwards, select the key by entering its number and pressing ENTER):

gpg --keyserver hkp://pool.sks-keyservers.net --search-keys CAA6A59611C7F07E

src: How-to verify GPG key of official .ISO images - Manjaro

[Yochanan]

It’s an issue with the default keyserver. If you’re brave, you can switch to the unstable branch and test gnupg 2.2.28-2.2 with patches to use keyserver.ubuntu.com.

FS#71078 - [gnupg] change default keyserver due to certificate expiration this month

Once upstream makes the needed changes, we can update the wiki accordingly.

EDIT: Wiki updated.

[Fabby]

I’ve marked this answer as the solution as it’s the best answer you’ll get:

Question on wiki: How-to verify GPG key of official .ISO images

It’s an issue with the default keyserver. If you’re brave, you can switch to the unstable branch and test gnupg 2.2.28-2.2 with patches to use keyserver.ubuntu.com. FS#71078 - [gnupg] change default keyserver due to certificate expiration this month Once upstream makes the needed changes, we can update the wiki accordingly.

If you disagree, feel free to:

• Take any other answer as the solution
• remove the solution altogether.

You’re in control but I just wanted to ensure that when other people have the same issue, they’ll find your Q&a as the authoritative answer…

[stargazer]

I don’t want to validate packages (well I do ), but these instructions were for validating an ISO.

I’m assuming that the wiki page is for a, lets say, non-manjaro user (opensuse) interested in validating the Manjaro ISO (because they want to switch maybe ). The wiki page lists specific gpg commands that use a now invalid key server.

[cfinnberg]

Yes, the problem here is not gpg itself, but the wiki that explicitly sets a now defunct server as keyserver.

[Strit]

@cfinnberg

but the wiki that explicitly sets a now defunct server as keyserver.

While the wiki does set the defunct keyserver, it is actually the same server as the GnuPG software itself sets as default. But it is still defunct.

So that line in the wiki, should just get updated to set a working keyserver.

[cfinnberg]

@Strit

So that line in the wiki, should just get updated to set a working keyserver.

That’s the point

Even if I have defined another keyserver (I have) that command sets a non functional keyserver.

[Yochanan]

@Strit

So that line in the wiki, should just get updated to set a working keyserver.

I just updated it.

[stargazer]

Should these two sentences on the wiki page also be changed to include the Manjaro Build Server?

Sentence 1 - current

4. Finally, verify if the .ISO image file was built by one of Manjaro’s Developers or Philip Müller:

Sentence 1 - suggested change

4. Finally, verify if the .ISO image file was built by the Manjaro Build Server, one of the Manjaro’s Developers, or Philip Müller:

Sentence 2 - current

If this is the case, you can be sure that your .iso file was built by Philip Müller or another Manjaro Developer.

Sentence 2 - suggested change

If this is the case, you can be sure that your .iso file was built by Philip Müller, another Manjaro Developer, or the Manjaro Build Server.

---

If you have some free time, items 1 and 2 should be reviewed for usability by non-Manjaro users.

For example:

items 1 & 2 - current

1. Download the an ISO file and corresponding .sig file from official sources(see Download Manjaro below)

2. Install GPG:

   sudo pacman -S gnupg wget

items 1 & 2 - suggested

1. Download an ISO file and the corresponding .sig file from the official sources (see Download Manjaro below).

2. Install GPG and wget using your current distribution’s package manager (pacman, apt, yast, rpm). For example, on Manjaro:

   sudo pacman -S gnupg wget

[Fabby]

Done, except for using pamac (Manjaro installer) instead of pacman (Arch) and left out other distros as it’s the Manjaro wiki.