Trying pacman 4.0.0rc2-1 before the official released version

ArchVortex · 2011-09-23 00:49:42

Here are instructions if you want to try the new pacman 4.0.0rc2-1 with package signing. You will have to remove pacman-colors and pkgbrowser if you use them because they aren't updated for pacman 4.0.0 yet.

You don't need to be as daring this time- we've had some 246 commits
since RC1. The most relevant changes is signing is about 95%
functional at this point- see directions below the links.
* pacman -U http://dev.archlinux.org/~dan/pacman-4. … pkg.tar.gz
* pacman -U http://dev.archlinux.org/~dan/pacman-4. … pkg.tar.gz
Please report any issues you may find with this package, as it is
getting very close to being an actual releasable version. These are
debug builds with symbols, so getting stack traces and helpful logging
should be relatively straight forward if necessary.
== How to enable package signature checking ==
1. Install above pacman RC package.
2. sudo pacman-key --init
3. `SigLevel = Optional` in pacman.conf is the default- for more info,
see man pacman.conf, but this means signatures will be checked *if
available*, and there will be no error if they are not. However, due
to us not having a web of trust for Arch developer keys, you will need
to add this to the [options] section:
SigLevel = Optional TrustAll
4. Run -Syu or any other operation that fetches packages from sync
databases. When it comes time to check package integrity, you may be
prompted to import keys that are not in your keychain. If a signature
is available, it will be used instead of sha256sums/md5sums.
-Dan

You actually only need to uncomment SigLevel = Optional TrustAll in /etc/pacman.conf

ArchVortex · 2011-09-23 01:06:07

Here's an example of what happens:

# root@ArchVortex stan]# pacman -Syu
:: Synchronizing package databases...
core is up to date
extra is up to date
community is up to date
:: Starting full system upgrade...
warning: pacman: local (4.0.0rc2-1) is newer than core (3.5.4-4)
resolving dependencies...
looking for inter-conflicts...
Targets (2): flashplugin-10.3.183.10-1 virtuoso-6.1.3-2
Total Download Size: 0.00 MiB
Total Installed Size: 45.54 MiB
Net Upgrade Size: 1.72 MiB
Proceed with installation? [Y/n] Y
(2/2) checking package integrity [######################] 100%
error: flashplugin: key "E8F18BA1615137BC" is unknown
:: Import PGP key 615137BC, "Ionut Biru <ibiru@archlinux.org>", created 2011-04-19? [Y/n] Y
(2/2) checking package integrity [######################] 100%
(2/2) loading package files [######################] 100%
(2/2) checking for file conflicts [######################] 100%
(1/2) upgrading flashplugin [######################] 100%.
(2/2) upgrading virtuoso [######################] 100%
[root@ArchVortex stan]#

So, until a web of trust for Arch developer keys is established, you will download developer keys for future use in your keyring. Right now the only difference security wise between pacman 3.5.4-4 and the pacman 4.0.0rc.2-1 is really nothing. Same lack of security. All you're doing is adding PGP keys with the new pacman and seeing how the new pacman will work.

pablokal · 2011-09-23 02:45:20

Thanks for the write up!!

Arch Linux

Announcement

#1 2011-09-23 00:49:42

Trying pacman 4.0.0rc2-1 before the official released version

#2 2011-09-23 01:06:07

Re: Trying pacman 4.0.0rc2-1 before the official released version

#3 2011-09-23 02:45:20

Re: Trying pacman 4.0.0rc2-1 before the official released version

Board footer