![在 Arch Linux 上的 pacman 中接受新的 PGP 密钥是否安全?](https://linux22.com/image/111516/%E5%9C%A8%20Arch%20Linux%20%E4%B8%8A%E7%9A%84%20pacman%20%E4%B8%AD%E6%8E%A5%E5%8F%97%E6%96%B0%E7%9A%84%20PGP%20%E5%AF%86%E9%92%A5%E6%98%AF%E5%90%A6%E5%AE%89%E5%85%A8%EF%BC%9F.png)
arch-audit
当之前尝试使用存储库在 Arch Linux 上安装时,sudo pacman -S arch-audit
我被告知:
resolving dependencies...
looking for conflicting packages...
Packages (1) arch-audit-0.1.8-3
Total Installed Size: 1.89 MiB
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [####################################################] 100%
downloading required keys...
error: key "D21461E3DFE2060D" could not be looked up remotely
error: required key missing from keyring
error: failed to commit transaction (unexpected error)
Errors occurred, no packages were upgraded.
但是现在,当我尝试安装它时,我收到此提示:
resolving dependencies...
looking for conflicting packages...
Packages (1) arch-audit-0.1.8-3
Total Installed Size: 1.89 MiB
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [######################] 100%
downloading required keys...
:: Import PGP key 4096R/6DAF7B808F9DF25139620000D21461E3DFE2060D, "Christian Rebischke <[email protected]>", created: 2015-07-16? [Y/n]
有问题的钥匙是从哪里进口的?接受它就一定安全吗?密钥是从官方可信服务器自动下载的还是只是随软件包或其他内容一起提供?