PACMAN-KEY(8)

📦
version 7.1.0.r9.g54d9411 · 13 versions
, in arch rolling

💖 pacman-key(8) — manage pacman's list of trusted keys 💖

okay bestie, welcome to the pacman-key(8) manual page, you're gonna eat this up, i promise 🫶

✨ SYNOPSIS ✨

pacman-key [options] operation [targets]

🌸 DESCRIPTION 🌸

So pacman-key is literally a wrapper script for GnuPG, and its whole job is managing pacman's keyring — which is the collection of PGP keys used to check signed packages and databases. She can import and export keys, fetch keys from keyservers, and update the key trust database. multitasking queen 👑

If you wanna do more complex keyring management, you can go straight to GnuPG and combine it with the --homedir option pointed at the pacman keyring (which lives in /etc/pacman.d/gnupg by default). iykyk 💅

Using pacman-key means you supply an operation, plus whatever options and targets you wanna operate on. Depending on the operation, a target can be a valid key identifier, a filename, or a directory. no biggie, just vibes ✨

🎀 OPERATIONS 🎀

  • -a, --add — adds the key(s) sitting in the specified file or files to pacman's keyring. If a key already exists, it gets updated. glow up 💖
  • -d, --delete — removes the key(s) identified by the specified keyid(s) from pacman's keyring. it's giving goodbye forever 😭
  • -e, --export — exports the key(s) identified by the specified keyid(s) to stdout. If you don't specify any keyid, literally all keys get exported.
  • --edit-key — presents a menu for key management tasks on the specified keyid(s). super useful for adjusting a key's trust level.
  • -f, --finger — lists a fingerprint for each specified keyid, or for all known keys if you didn't specify any keyids. main character fingerprint reveal 🔍
  • -h, --help — outputs syntax and command line options.
  • --import — imports keys from pubring.gpg into the public keyring from the specified directories.
  • --import-trustdb — imports ownertrust values from trustdb.gpg into the shared trust database from the specified directories.
  • --init — makes sure the keyring is properly initialized and has the required access permissions. setting her up for success ✨
  • -l, --list-keys — lists all keys, or the specified keys, from the public keyring.
  • --list-sigs — same as --list-keys, but the signatures are listed too. more info, more slay.
  • --lsign-key — locally signs the given key. this is primarily used to root the web of trust in the local private key generated by --init.
  • --nocolor — disables colored output from pacman-key. (sad, but sometimes you gotta 🙈)
  • -r, --recv-keys — equivalent to --recv-keys in GnuPG.
  • --refresh-keys — equivalent to --refresh-keys in GnuPG.
  • --populate — reloads the default keys from the (optionally provided) keyrings in /usr/share/pacman/keyrings. For more info, see Providing a Keyring for Import below.
  • -u, --updatedb — equivalent to --check-trustdb in GnuPG. This operation can be specified with other operations.
  • -V, --version — displays the program version.
  • -v, --verify — assumes that the first argument is a signature and verifies it. If a second argument is provided, that's the file to be verified.

With only one argument given, it assumes that the signature is a detached signature, and looks for a matching data file to verify by stripping the file extension. If no matching data file is found, it falls back on GnuPG semantics and attempts to verify a file with an embedded signature.

🦋 OPTIONS 🦋

  • --config <file> — use an alternate configuration file instead of the /etc/pacman.conf default.
  • --gpgdir <dir> — set an alternate home directory for GnuPG. If you don't specify one, the value is read from /etc/pacman.conf.
  • --keyserver <keyserver> — use the specified keyserver if the operation requires one. This takes precedence over any keyserver option specified in a gpg.conf configuration file. Running --init with this option will set the default keyserver if one wasn't already configured.

🌈 PROVIDING A KEYRING FOR IMPORT 🌈

A distribution or other provided repository might wanna provide a set of PGP keys used in the signing of its packages and repository databases that can be readily imported into the pacman keyring. The way to do this? Provide a PGP keyring file foo.gpg that contains the keys for the foo keyring in the directory /usr/share/pacman/keyrings. it's giving organized 💅

Optionally, you can also provide the file foo-trusted, containing a list of trusted key IDs for that keyring. This is a file in a format compatible with gpg --export-ownertrust output. This file will inform the user which keys a user needs to verify and sign to build a local web of trust, in addition to assigning provided owner trust values. 🫶

Also optionally, you can provide the file foo-revoked, containing a list of revoked key IDs for that keyring. "Revoked" is defined as "no longer valid for any signing", so this should be used with prudence. A key being marked as revoked will be disabled in the keyring and no longer treated as valid, so this always takes priority over its trusted state in any other keyring.

⚠️ bestie, listen — revoked is serious business. "no longer valid for any signing" is not a drill, use it with prudence. 💀

⭐ SEE ALSO ⭐

See the pacman website at https://archlinux.org/pacman/ for current information on pacman and its related tools. 🌐

💀 BUGS 💀

Bugs? You must be kidding; there are no bugs in this software. 😌✨

But if we happen to be wrong, please report them to the issue tracker at https://gitlab.archlinux.org/pacman/pacman/-/issues with specific information such as your command-line, the nature of the bug, and even the package database if it helps. be a good citizen and give the details fr fr 🙏

👑 AUTHORS 👑

Current maintainers:

  • Allan McRae <allan@archlinux.org>
  • Andrew Gregory <andrew.gregory.8@gmail.com>
  • Morgan Adamiec <morganamilo@archlinux.org>

Past major contributors:

  • Judd Vinet <jvinet@zeroflux.org>
  • Aurelien Foret <aurelien@archlinux.org>
  • Aaron Griffin <aaron@archlinux.org>
  • Dan McGee <dan@archlinux.org>
  • Xavier Chantry <shiningxc@gmail.com>
  • Nagy Gabor <ngaba@bibl.u-szeged.hu>
  • Dave Reisner <dreisner@archlinux.org>
  • Eli Schwartz <eschwartz@archlinux.org>

For additional contributors, use git shortlog -s on the pacman.git repository.

okay that's the whole page bestie, you're officially a pacman-key girlie now 💖✨

Pacman 7.1.0 · dated 2026-10-15 · PACMAN-KEY(8) — mwah, love u, go sign some keys 🎀💅

📦 where this page comes from