BlackArch/blackarch

insecure fix for the gpg signature issue

Juesto opened this issue · 3 comments

Juesto commented

adding allow-weak-key-signatures to the beginning of /etc/pacman.d/gnupg/gpg.conf solves the problem
this is suggested by gpg itself when you try to locally sign an affected key say, noptrix blackarch developer key
should be much better than downgrading gpg and resetting the keyring

noraj commented

This has already be mentioned in the solution in one of the solved issues https://github.com/BlackArch/blackarch/issues?q=is%3Aissue+error%3A+blackarch%3A+signature+from+%22Levon+%27noptrix%27+Kayan+is%3Aclosed

But this is obviously the easy and bad way to handle it. Other solutions may be preferable.

re-opening for re-testing.

@Juesto thank you very much. this worked and we've updated the strap.sh accordingly. we'll use this tmp-fix until we come up with an updated keyring.