Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite
1

The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf.

Its not supposed to be the right way, but I don't seem to be able to get pacman going any other options for SigLevel.

Is what I'm doing right? And is it a frequent and common security threat that I should worry about, every second, day and night?

Thanks.

share|improve this question

2 Answers

up vote 4 down vote accepted

As of the end of this month, March 2012, all of the packages in the main databases (Core, Extra, Community and Multilib) and their Testing variants are signed. This means that you are able to, and should consider if you are interested in securing your machine, use Required in your SigLevel.

Once you have checked and signed the master keys, it does not take long to authorize the other keys in the day-to-day updating of your machine.

It would be overstating it greatly to describe this as an inconvenience and it is more than offset by the peace of mind that you will enjoy over the much longer term if you set this up properly now.

share|improve this answer
Yep, you're right, which to me means drive for more in depth studies, and I apologize for the question to be somehow foolish! :-D But, I also have another question: What in case I install packages offline, and I use --cachedir to inform packman about it? What is the right approach in that case? (Thank you) – ai64 Mar 27 '12 at 14:53
You are still using pacman to install the packages. If you are building them yourself, you can add your own key to pacman's keyring. – jasonwryan Mar 27 '12 at 17:59
No no, I'm using the repository packages. I only had to install Arch on 2-3 PCs the first time I got going with it, and beucase I didn't wanna download all the packages everytime, including LXDE and so, I copied them from /var/cache/pacman/pkg/ and tried using them on other PCs, but I used to get the Signature error. That's why I asked. ;-) – ai64 Mar 28 '12 at 8:14
up vote 0 down vote

If you don't want to bother with this, do it like me :

SigLevel = Optional TrustAll
share|improve this answer
We know that SigLevel is a security consideration and its not gonna be so that you'll be a victim right at the moment you put SigLevel = None, but how much really does Optional TrustAll increase security in a way that affects user's daily actions? And besides, why should there be packages listed in the repositories which's developer's keys are untrusted by pacman? How would the repository mean to be secure and trustable then? – ai64 Mar 26 '12 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.