mod_fcgid
- Path: arch/maintained/mod_fcgid (new – vendored from AUR 2026-08-02
to unblock thruk, along with perl-plack/perl-log-dispatch)
- 2026-08-02: added as a submodule from AUR. Build fails at source
download/verify:
mod_fcgid-2.3.9.tar.bz2 ... FAILED (unknown
public key EC582EB639FF092C) – Jeff Trawick’s Apache signing key
isn’t in the build chroot’s GPG trust store.
- Investigated the
keys/pgp/<fingerprint>.asc convention used
elsewhere in this tree (e.g. fcitx, kscreenlocker5) – confirmed
by reading /usr/share/makepkg: that directory is only consumed
by makepkg --source to embed keys in a srcpkg tarball for
downstream reproducibility (see makepkg’s create_srcpackage,
~line 836). It is not auto-imported into the GPG homedir used for
check_pgpsigs() verification – added the correct key there
anyway (via scripts/update_pgp_key_dir.sh’s same
gpg --export-equivalent approach, fetched from
keyserver.ubuntu.com since AUR’s own git-ssh was down) but it made
no difference, confirming this theory.
- The actual GPG homedir used during a real build lives inside the
ephemeral per-build chroot copy (rsync’d fresh from
/var/lib/archbuild/archlinuxaba-x86_64/root on every invocation),
under the dynamically-created builduser’s ~/.gnupg – there is
no stable, persistent location to pre-seed a trusted key without
modifying the shared chroot root filesystem itself (a
higher-risk, cross-package change, not something to do for one
package’s sake). --skippgpcheck isn’t used for real builds in
this project’s convention (only for --nobuild config-reconciliation
runs like linux-lts515’s update.sh), so that’s not an option either.
- Not fixed. Whoever picks this up next needs to either seed the
shared chroot’s keyring properly (a
scripts/ change, benefits
every future PGP-signed package) or find another sanctioned way to
trust this specific key.