Yay => WARNING: Skipping verification of source file PGP signatures

Technical Issues
1

Good day,

I was curious about this message when updating the system, so asked Claude to investigate. Ordinarily I’d write-off any A.I. output, but Claude is proving to be more talented each day. What it found was interesting, so decided to share it here:

Q: Mabox (Arch, Manjaro) Linux question. ‘yay’ returns ‘==> WARNING: Skipping verification of source file PGP signatures’ on most if not all system upgrades. Can you determine if something is wrong?`

A: Searched for 2 patterns, ran 8 shell commands.

  • Short answer: nothing is wrong with your system. This is yay’s normal, by‑design behaviour, and your config is stock.

Where the warning comes from:

The line ==> WARNING: Skipping verification of source file PGP signatures. is printed by makepkg, from /usr/share/makepkg/integrity.sh, and only when makepkg is run with --skippgpcheck (or --skipinteg).

yay passes --skippgpcheck to makepkg by default (the flag string is right there in the yay binary). yay does this deliberately: it handles PGP keys itself — that’s the pgpfetch prompt you occasionally see (“Import PGP key … ? [Y/n]”) — and tells makepkg not to also do it, so a build doesn’t hard‑fail halfway through on a missing key. Because the flag is passed on essentially every AUR build, you see the warning on essentially every AUR build.

Your settings are all defaults / not the cause:

  • /etc/makepkg.conf: BUILDENV=(… check !sign) — !sign only means “don’t sign the output package”, unrelated to source verification. Nothing globally disables PGP.
  • yay: mflags empty, gpgflags empty, pgpfetch: true.

What’s still checked vs. what’s skipped

In the --skippgpcheck path, makepkg still verifies the sha256 checksums in the PKGBUILD (check_checksums still runs). So it is not “no integrity checking.”

What’s skipped is the upstream author’s GPG signature on the source tarball, for the minority of AUR packages that ship one (validpgpkeys + a .sig/.asc source). For those, you’re trusting the sha256sum in the PKGBUILD plus the assumption that the PKGBUILD itself came from the AUR unmodified.

Repo packages (core/extra/multilib, SigLevel = PackageRequired, [many] keys in your keyring) are fully signature‑verified by pacman — this warning never applies to them, only to the AUR build step.

If you want stricter behaviour

  • Per package: git clone https://aur.archlinux.org/<pkg>.git && cd <pkg> && makepkg -si — runs makepkg without the flag, so signatures are verified (after keys are imported).
  • Switch to paru: it doesn’t force --skippgpcheck; it runs makepkg --verifysource with real PGP checking after importing keys.
  • You can’t un‑set the flag via yay’s mflags.

Unrelated but more significant — your Mabox repo

While checking, I noticed /etc/pacman.conf lines 75–77:

[maboxlinux]
SigLevel = Optional TrustAll
Server = http://repo.maboxlinux.org/stable/$arch/

Packages from Mabox’s own repo are installed with no signature check, over plain HTTP — a genuine MITM / supply‑chain exposure, broader than the cosmetic yay warning. That’s the Mabox distro default, not something you did, but if the yay warning bothers you, this deserves more attention: check whether repo.maboxlinux.org offers HTTPS, and whether they sign packages (if so, set SigLevel = Required).

[No signing, but looks like we can edit /etc/pacman.conf and change that http to a https.]

Also: the ~/.config/yay/init.lua you have has an “archcanary” yay‑13 Lua hook that scans PKGBUILDs for malicious patterns before each build — so your AUR path does have an active pre‑build check, above and beyond PGP / sha256sum.

[Wow, kudos to Claude for figuring that out! And thanks to muzqs for creating it. :slight_smile: If you use the AUR, check out archcanary if you haven’t already: https://forum.maboxlinux.org/t/community-archcanary-aur-supply-chain-scanner]