Where can I find package signatures?

Question

linux

Tried to install mullvad vpn via pamac but installation failed. Distribution - manjaro

==> Проверка файлов source с использованием sha256sums...
    mullvadvpn-app ... Пропущено
    mullvadvpn-app-binaries ... Пропущено
    mullvad-vpn.sh ... Готово
==> Проверка подписей исходных файлов с помощью 'gpg'...
    mullvadvpn-app git repo ... ПОДПИСЬ НЕ НАЙДЕНА
    mullvadvpn-app-binaries git repo ... ПОДПИСЬ НЕ НАЙДЕНА
==> ОШИБКА: Одна или больше PGP-подписей не могут быть проверены!
Finished with result: exit-code
Main processes terminated with: code=exited/status=1
Service runtime: 5min 10.923s
CPU time consumed: 28.959s
Ошибка: Не удалось собрать mullvad-vpn

Answer 1

there, below in the comments under this package in the AUR , the post of the maintainer of this package is fixed :

--> ALWAYS DO A CLEAN BUILD <--
This package will verify the signature of the git tag / commit. Developer keys are available here and instructions are here . See the PKGBUILD to determine which developer key you need.

that is, see the PKGBUILD of this package
, namely this particular variable:

validpgpkeys=('EA0A77BF9E115615FC3BD8BC7653B940E494FE87'
              # Linus Färnstrand (code signing key) <[email protected]>
              '8339C7D2942EB854E3F27CE5AEE9DECFD582E984'
              # David Lönnhager (code signing) <[email protected]>
              )

we need the keys:
Linus Färnstrand
David Lönnhager
go here and download them
and then here and see how to install them
if specifically we
gpg2 --import xxxx.asc
clean the caches from previous package installations:
sudo pacman -Scc
well, then try to install this package already