I create Manjaro spins and for them I have a repository for packages.
I create the packages with
makepkg --sign --key "my key here"
My real gpgkey id is in place of “my key here”` It makes the package and a .sig file.
I place both files in a folder, and use the following command
repo-add sbk-repo.db.tar.gz *.pkg.tar.* -s
The problem is that running repo-add command gives an error.
==> Adding package 'silver-cursor-1-0-any.pkg.tar.xz'
-> Adding package signature...
-> Computing checksums...
-> Creating 'desc' db entry...
-> Creating 'files' db entry...
==> ERROR: 'silver-cursor-1-0-any.pkg.tar.xz.sig' is not a package file, skipping
According to the Arch repo-add page “If a matching “.sig” file is found alongside a package file, the signature will automatically be embedded into the database.” But the errors stop the database from being created.
It worked! But the reason *.pkg.tar.* is in the command is I have 144 packages. I used the admittedly old silver cursor package as a test package in a test directory to try and make it simple for solving this issue. The question now is can I somehow run this command on a folder full of packages and not have it pickup the sig files as files to process.
As a work around I tee’d a ls into a txt file of the directory without sig files and then used that as a replacement for *.pkg.tar.* in the command after replacing the sig files. It worked.
Yochanan
The silver-cursor package is very old. I was just using it as a test file in a test folder to work through this problem without having 143 other packages to process.
I know I can add the key to makepkg.conf but I long ago changed the timeout on the passphrase to 8 hours since its a computer in my house that no one else has access to and its off when I am not home. Once every 8 hours isnt that bad.