Arch Linux

Summary and Info:

If a key is missing if you are running updates via “pacman -Su” pacman tries to recieve the keys, but fails with the default keyserver (hkp://keys.gnupg.net) because the key is not found (although it is on the keyserver):

Fehler: opera: key "BBE43771487328A9" is unknown
debug: looking up key BBE43771487328A9 remotely
debug: key lookup failed, unknown key
debug: looking up key 487328A9 remotely
debug: key lookup failed, unknown key
debug: gpg error: Dateiende
Fehler: key "BBE43771487328A9" could not be looked up remotely
debug: looking up key DA6426DD215B37AD locally
debug: key lookup failed, unknown key

(“Fehler” is german l18n for “Error”, just in case)

This can be reduced in pacman-key:

root@merkur:~# pacman-key -r 426991CD8406FFF3
gpg: fordere Schlüssel 8406FFF3 von hkp-Server keys.gnupg.net an
gpgkeys: HTTP fetch error 7: couldn't connect: End of file
gpg: Keine gültigen OpenPGP-Daten gefunden.
gpg: Anzahl insgesamt bearbeiteter Schlüssel: 0
==> FEHLER: Entfernter Schlüssel konnte nicht korrekt vom Schlüssel-Server abgerufen werden.

(different key for I had already imported the first one)

However, the following works:

root@merkur:~# pacman-key -r 0x426991CD8406FFF3
gpg: fordere Schlüssel 8406FFF3 von hkp-Server keys.gnupg.net an
gpg: Schlüssel 8406FFF3: Öffentlicher Schlüssel "Ronald van Haren <ronald@archlinux.org>" importiert
gpg: 3 marginal-needed, 1 complete-needed, PGP Vertrauensmodell
gpg: Tiefe: 0 gültig: 1 signiert: 5 Vertrauen: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Tiefe: 1 gültig: 5 signiert: 26 Vertrauen: 0-, 0q, 0n, 5m, 0f, 0u
gpg: Tiefe: 2 gültig: 26 signiert: 2 Vertrauen: 26-, 0q, 0n, 0m, 0f, 0u
gpg: Anzahl insgesamt bearbeiteter Schlüssel: 1
gpg: importiert: 1 (RSA: 1)
==> Aktualisiere Trust-Datenbank
gpg: "Trust-DB"-Überprüfung nicht nötig


Once you imported the key, both commands behave identical again:

root@merkur:~# pacman-key -r 426991CD8406FFF3
gpg: fordere Schlüssel 8406FFF3 von hkp-Server keys.gnupg.net an
gpg: Schlüssel 8406FFF3: "Ronald van Haren <ronald@archlinux.org>" nicht geändert
gpg: Anzahl insgesamt bearbeiteter Schlüssel: 1
gpg: unverändert: 1
==> Aktualisiere Trust-Datenbank
gpg: "Trust-DB"-Überprüfung nicht nötig

(exactly the same for “pacman-key -r 0x426991CD8406FFF3”).

My guess what's the problem: keys.gnupg.net only interprets strings with 0x at the beginning as hex. This can be seen when using the webinterface: http://keys.gnupg.net/

Probably pacman asks for 426991CD8406FFF3 instead of 0x426991CD8406FFF3.

Steps to Reproduce:

Install a package signed by a developer whose key is now yet owned by you.