Hello,
Is it expected that a Manjaro mirror can go offline without notice?
Indeed, between June 12th and June 19th the mirror https://manjaro.ynh.ovh/ went offline. Since then (2-3 weeks), it has not been brought online. The status on https://repo.manjaro.org/ is “unknown”. So, with the recent security events I wonder if this mirror going offline unnoticed is the sign of a security threat for users and / or the Manjaro infrastructure.
Thanks.
One would hope that they can all stay up 24/7, but there’s a reason we have many… which is why you can update and check their status before using them.
The fact that you didn’t notice is neither here nor there - an offline mirror can’t serve malicious packages and the package signing system is what protects against compromised mirrors.
It’s not ideal, but it’s fairly common for mirrors to come and go.
sudo pacman-mirrors -f8 --timeout 3
Just move on 
No - that is not a security threat.
And as you can see from the status page - it is not unnoticed.
However - Manjaro Linux has no influence on the mirrors - any and all mirrors is provided as is by the respective provider, without any guarantees of continued service.
Many mirrors are run by private entities.
The pacman-mirrors utility will never suggest a mirror with status unknown - unless you instruct it to - by manually providing the --no-status argument.
Thank you both @Ben and @ManjaroDevOps for your detailed answers.
I understand that no supply chain attack can happen through mirrors and that the status “unknown” is not a status resulting from an error but an equivalent of “unreachable”.
I was using this mirror. So I did notice as pacman -Syu failed.