commit 19ab7aeaf81bc14b8f631b4cff0e4d8869ec1c76
Author: Warky <2+warkanum@noreply@warky.dev>
Date:   Thu Oct 15 16:55:26 2026 +0000

    Add Arch Linux repository setup and key troubleshooting

diff --git a/Arch-Linux-Repository.md b/Arch-Linux-Repository.md
new file mode 100644
index 0000000..c005810
--- /dev/null
+++ b/Arch-Linux-Repository.md
@@ -0,0 +1,52 @@
+# Arch Linux Repository
+
+## Setup
+
+`/etc/pacman.conf`:
+
+```ini
+[relspec]
+SigLevel = Optional TrustAll
+Server = https://git.warky.dev/api/packages/wdevs/arch/$repo/$arch
+```
+
+Import the signing key:
+
+```sh
+curl -sSf https://git.warky.dev/api/packages/wdevs/arch/repository.key -o /tmp/relspec.key
+sudo pacman-key --add /tmp/relspec.key
+sudo pacman-key --lsign-key <FINGERPRINT>
+```
+
+Get the fingerprint: `gpg --show-keys /tmp/relspec.key`
+
+Install: `yay -Sy relspec` (or `sudo pacman -Sy relspec`)
+
+## Troubleshooting: unknown key
+
+```
+error: relspec: key "<KEYID>" is unknown
+error: database 'relspec' is not valid (invalid or corrupted database (PGP signature))
+```
+
+- Cause: the registry signing key was rotated; the local keyring has the old key.
+- `SigLevel = Optional TrustAll` does not help — a signature from a missing key still fails.
+- `keyring is not writable` only means the command ran without root; it is not the cause.
+
+Fix: re-import the current key (Setup steps above), then `yay -Sy relspec`.
+
+Check which key signs the DB:
+
+```sh
+curl -sSfO https://git.warky.dev/api/packages/wdevs/arch/relspec/x86_64/relspec.db.sig
+gpg --list-packets relspec.db.sig | grep 'issuer fpr'
+```
+
+Remove an old key: `sudo pacman-key --delete <OLD_FINGERPRINT>`
+
+## Key history
+
+| Fingerprint | Created |
+|---|---|
+| `13DACD9EE6E5BA4ED059113B4672DC0F3BDF6DE9` | 2026-10-14 (current) |
+| `3354C1D1D0277531BB57A2E71289ABA000C5D933` | 2026-09-11 (old) |
\ No newline at end of file