pacman

Hi! First off, I would like to thank you for the amazing work and effort you put into yay. It makes managing AUR packages a breeze!

I'm interested in replacing sudo with doas (a leaner alternative to sudo) on my system, but right now yay-bin is the only program that explicitly depends on sudo and effectively makes the move impossible; unless I keep both sudo and doas. I find tha

I have multiple packages installed from AUR which are offered for update every time I run yup but IMHO they shouldn't.

I.e. in todays output:

==> Checking for AUR updates...

==> Found 2 local package(s) that are newer than their AUR package
    numix-icon-theme-pack-git  r6767-1 has AUR version r6086-1
    ttf-consolas-with-yahei-powerline-git  r.-1 has AUR version r14.b6e9163-1

If packages/database uses signing then one needs to run gpg --detach-sign manually each time a package is added to the repo.

It makes sense if repoctl has an option to automate the signing process. i.e.

• run gpg signing for the package before adding it to database
• run gpg signing for the database after the package is added to database