From 7112586707928170bcde7075b79680d8ea9e5920 Mon Sep 17 00:00:00 2001 From: Spencer Bull Date: Mon, 5 Oct 2026 01:22:15 -0500 Subject: [PATCH] Fall back to keyserver.ubuntu.com for the repository key in the builder image The builder fetched Omarchy's repository key only from keys.openpgp.org, so when that server stopped answering every builder-image build failed with "Remote key not fetched correctly from keyserver". The key is pinned by its full fingerprint, so the keyserver is only transport, and a second one serves the same key. --- build/Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/build/Dockerfile b/build/Dockerfile index 2a81a6205..4632a92df 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -113,7 +113,10 @@ RUN ln -sf /usr/lib/os-release /etc/os-release && \ # aarch64 build depend on an aarch64 repository that only that build can # create. ARG MIRROR=edge -RUN pacman-key --recv-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571 --keyserver keys.openpgp.org && \ +# The full fingerprint is what is trusted; a keyserver is only transport, so a +# second one keeps an outage of the first from failing every build. +RUN { pacman-key --recv-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571 --keyserver hkps://keys.openpgp.org || \ + pacman-key --recv-keys 40DFB630FF42BCFFB047046CF0134EE680CAC571 --keyserver hkps://keyserver.ubuntu.com; } && \ pacman-key --lsign-key 40DFB630FF42BCFFB047046CF0134EE680CAC571 && \ printf '\n[omarchy]\nSigLevel = Optional\nServer = https://pkgs.omarchy.org/%s/x86_64\n' "${MIRROR}" >> /etc/pacman.conf && \ pacman -Sy --noconfirm && \