From f2880f1f71ce6f1af5330af1ace9da0f20145bc4 Mon Sep 17 00:00:00 2001
From: Warky <2+warkanum@noreply@warky.dev>
Date: Thu, 15 Oct 2026 16:56:14 +0000
Subject: [PATCH] Add explicit key rotation fix steps

---
 ...-Repository.md => Arch-Linux-Repository.-.md | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
 rename Arch-Linux-Repository.md => Arch-Linux-Repository.-.md (80%)

diff --git a/Arch-Linux-Repository.md b/Arch-Linux-Repository.-.md
similarity index 80%
rename from Arch-Linux-Repository.md
rename to Arch-Linux-Repository.-.md
index c005810..9b9f0d5 100644
--- a/Arch-Linux-Repository.md
+++ b/Arch-Linux-Repository.-.md
@@ -33,7 +33,20 @@ error: database 'relspec' is not valid (invalid or corrupted database (PGP signa
 - `SigLevel = Optional TrustAll` does not help — a signature from a missing key still fails.
 - `keyring is not writable` only means the command ran without root; it is not the cause.
 
-Fix: re-import the current key (Setup steps above), then `yay -Sy relspec`.
+Fix:
+
+```sh
+curl -sSf https://git.warky.dev/api/packages/wdevs/arch/repository.key -o /tmp/relspec.key
+sudo pacman-key --add /tmp/relspec.key
+sudo pacman-key --lsign-key 13DACD9EE6E5BA4ED059113B4672DC0F3BDF6DE9
+yay -Sy relspec
+```
+
+Optional cleanup:
+
+```sh
+sudo pacman-key --delete 3354C1D1D0277531BB57A2E71289ABA000C5D933
+```
 
 Check which key signs the DB:
 
@@ -42,8 +55,6 @@ curl -sSfO https://git.warky.dev/api/packages/wdevs/arch/relspec/x86_64/relspec.
 gpg --list-packets relspec.db.sig | grep 'issuer fpr'
 ```
 
-Remove an old key: `sudo pacman-key --delete <OLD_FINGERPRINT>`
-
 ## Key history
 
 | Fingerprint | Created |