The only way I can install majority of packages without rejection from signature database is to put SigLevel = Never in pacman.conf.Its not supposed to be the right way, but I don't seem to be able to get pacman going any other options for SigLevel.Is what I'm doing right? And is it a frequent and common security threat that I should worry about, every second, day and night?Thanks.
Arch: Is SigLevel = Never the only convenient way?
security;arch linux;configuration;pacman
As of the end of this month, March 2012, all of the packages in the main databases (Core, Extra, Community and Multilib) and their Testing variants are signed. This means that you are able to, and should consider if you are interested in securing your machine, use Required in your SigLevel.Once you have checked and signed the master keys, it does not take long to authorize the other keys in the day-to-day updating of your machine.It would be overstating it greatly to describe this as an inconvenience and it is more than offset by the peace of mind that you will enjoy over the much longer term if you set this up properly now.