[HowTo] Work around gpg verification issue on left behind systems

megavolt · 3 November 2022 10:12

Difficulty: ★☆☆☆☆

This script is the result of people here in the forum having problems with Manjaro installations that haven’t been updated for more than 2 months or booting an old ISO plus installing it which is older than 2 months. I was a bit tired of explaining how to solve that issue and created a script, which does the job.

Methods

Method 1 - Basic

Remove lock files of pamac and pacman

Refresh Package Database

Populate local keyrings to the GnuPG Database of pacman

Refresh GnuPG Database of pacman from the Internet [optional]

Performing a full upgrade with pacman [optional]

Method 2 - Moderate

Remove lock files of pamac and pacman

Remove Pacman’s GnuPG Database

Initilize Pacman’s GnuPG Database

Populate local keyrings to Pacman’s GnuPG Database

Refresh GnuPG Database of pacman from the Internet [optional]

Remove cached software packages [optional]

Performing a full upgrade with pacman [optional]

Method 3 - Aggressive

Remove lock files of pamac and pacman

Switch to global mirror (Manjaro’s CDN)

Remove Pacman’s GnuPG Database

Initilize Pacman’s GnuPG Database

Remove cached software packages

Create a temporary folder in /tmp

Copy /etc/pacman.conf to TMPDIR/pacman.conf and disable temporarily gpg verification.

Download the newest packages which contains the gpg keyrings in TMPDIR

Install temporarily downloaded keyring packages

Remove temporary directory TMPDIR

Switch to a local mirror by Geolocation

Refresh GnuPG Database of pacman from the Internet [optional]

Performing a full upgrade with pacman [optional]

Addition: Fix GPGme Errors

Remove all Signatures at /var/lib/pacman/sync/

Remove all Signatures at /var/cache/pacman/pkg/

Remove lock files of pamac and pacman

Refresh Package Database

Performing a full upgrade with pacman

The third one is just the original old script. Method 1 and 2 are inspired by [HowTo] Solve Keyring Related Issues in Manjaro

Added an automated fix for gpgme errors like here described: [root tip] [How To] Mitigate and prevent GPGME error when syncing your system

In a nutshell:

curl requests a *.sig file and the server responds with 200 [OK], but has sent an HTML file with the message 404 [NOT FOUND], although it should respond with the status code 404 [NOT FOUND].

So an incorrectly configured server.

Now there are signature files that have HTML content. This leads to problems with pacman, as pacman cannot do anything with them, but wants to check the databases with the “signatures” that have the wrong content. This means that no update can be carried out here. You should delete the corresponding signature files with incorrect content.

Script

###START###
#!/usr/bin/env bash

set -o errexit  #>Exit when a command fails (returns non-zero)
set -o pipefail #>Exit when a command within a pipeline fail (returns non-zero)
set -o nounset  #>Forbid to use unset

# Reset language to default
export LANG=C
export LC_ALL=C

# Switch to root account
RunasRoot () { sudo --login --user=root "$@"; }

# Colors for messages
PrintInfo () { printf '\e[32m[INFO]\e[0m \e[33m%s\e[0m\n' "$1"; }
PrintError () { printf '\e[31m[ERROR]\e[0m \e[33m%s\e[0m\n' "$1"; }
PrintQuestion () { printf '\e[35m[QUESTION]\e[0m \e[33m%s\e[0m\n' "$1"; }

RmLockFiles () 
{
   PrintInfo "Remove lock files of pamac and pacman"
   ##Seems to be obsolete
   #RunasRoot find /var/tmp/pamac/ -type f -iname "*db.lck" -exec rm --force --verbose "{}" \;
   RunasRoot find /var/lib/pacman/ -type f -iname "*db.lck" -exec rm --force --verbose "{}" \;
}

AskForUpgrade ()
{
   PrintInfo "Performing a full upgrade with pacman"
   while true; do
      PrintQuestion "Do you want to continue? [Yy/Nn] (Be aware that a full upgrade needs enough ram on a live session)"
      read -p "> [Yy/Nn] " yn
      case $yn in
      [Yy]*) 
         RunasRoot pacman --sync --refresh --refresh --sysupgrade --sysupgrade --noconfirm
         PrintInfo "Done. Note that you need to refresh the database for pamac also."
         break
      ;;
      [Nn]*) 
         break
      ;;
      *)
         RunasRoot pacman --sync --refresh --refresh --sysupgrade --sysupgrade --noconfirm
         PrintInfo "Done. Note that you need to refresh the database for pamac also."
         break
      ;;
      esac
   done
}

AskForRefreshKeys ()
{
   PrintInfo "Refresh GnuPG Database of pacman from the Internet"
   while true; do
      PrintQuestion "Do you want to continue? [Yy/Nn] (Note that this can take a while.)"
      read -p "> [Yy/Nn] " yn
      case $yn in
      [Yy]*) 
         RunasRoot pacman-key --refresh-keys
         break
      ;;
      [Nn]*) 
         break
      ;;
      *)
         RunasRoot pacman-key --refresh-keys
         break
      ;;
      esac
   done
}

AskForRemoveCache ()
{
   PrintInfo "Remove cached software packages [optional]"
   while true; do
      PrintQuestion "Delete them? [Yy/Nn]"
      read -p "[Yy/Nn] > " yn
      case $yn in
      [Yy]*)
         PrintInfo "Removing package cache"
         RunasRoot pacman --sync --clean --clean --noconfirm
         if [[ $(ls /var/cache/pacman/pkg/ | wc -l) != 0 ]]; then
            RunasRoot find /var/cache/pacman/pkg/ -type f -exec rm --force --verbose "{}" \;
         fi
      ;;
      [Nn]*) 
         break
      ;;
      *)
         PrintInfo "Removing package cache"
         RunasRoot pacman --sync --clean --clean --noconfirm
         if [[ $(ls /var/cache/pacman/pkg/ | wc -l) != 0 ]]; then
            RunasRoot find /var/cache/pacman/pkg/ -type f -exec rm --force --verbose "{}" \;
         fi
      esac
   done
}

BasicMethod ()
{
   RmLockFiles

   PrintInfo "Refresh Package Database"
   RunasRoot pacman --sync --refresh --refresh

   PrintInfo "Populate local keyrings to the GnuPG Database of pacman"
   RunasRoot pacman-key --populate archlinux manjaro

   AskForRefreshKeys

   AskForUpgrade
}

ModerateMethod ()
{
   RmLockFiles

   PrintInfo "Remove Pacman's GnuPG Database"
   RunasRoot find /etc/pacman.d/gnupg/ -exec rm --recursive --force --verbose "{}" \;

   PrintInfo "Initilize Pacman's GnuPG Database"
   RunasRoot pacman-key --init

   PrintInfo "Populate local keyrings to Pacman's GnuPG Database"
   RunasRoot pacman-key --populate archlinux manjaro

   AskForRefreshKeys

   AskForRemoveCache

   AskForUpgrade
}

AggressiveMethod ()
{
   RmLockFiles
   
   PrintInfo "Switch to global mirror (Manjaro's CDN)"
   RunasRoot pacman-mirrors --country Global
   RunasRoot pacman-mirrors --fasttrack 5

   PrintInfo "Remove Pacman's GnuPG Database"
   RunasRoot find /etc/pacman.d/gnupg/ -exec rm --recursive --force --verbose "{}" \;

   PrintInfo "Initilize Pacman's GnuPG Database"
   RunasRoot pacman-key --init

   PrintInfo "Removing package cache"
   RunasRoot pacman --sync --clean --clean --noconfirm
   if [[ $(ls /var/cache/pacman/pkg/ | wc -l) != 0 ]]; then
      RunasRoot find /var/cache/pacman/pkg/ -type f -exec rm --force --verbose "{}" \;
   fi

   PrintInfo "Create a temporary folder in /tmp"
   TMPDIR="$(mktemp -d)"
   RunasRoot chmod -R 755 "${TMPDIR}"
   RunasRoot chown -R root:root "${TMPDIR}"
   PrintInfo "${TMPDIR}"

   PrintInfo "Copy /etc/pacman.conf to ${TMPDIR}/pacman.conf and disable temporarily gpg verification."
   RunasRoot cp "/etc/pacman.conf" "${TMPDIR}/pacman.conf"
   RunasRoot sed --in-place --regexp-extended 's/^(SigLevel).+$/\1 = Never/g' "${TMPDIR}/pacman.conf"

   PrintInfo "Download the newest packages which contains the gpg keyrings in ${TMPDIR}"
   RunasRoot pacman --sync --refresh --downloadonly --noconfirm --cachedir "${TMPDIR}" --config "${TMPDIR}/pacman.conf" archlinux-keyring manjaro-keyring gnupg --overwrite "*"

   PrintInfo "Install temporarily downloaded keyring packages"
   RunasRoot pacman --upgrade --noconfirm --config "${TMPDIR}/pacman.conf" --overwrite "*" $(find ${TMPDIR} -type f -name "*.tar.*")

   PrintInfo "Remove temporary directory: ${TMPDIR}"
   RunasRoot find "${TMPDIR}" -type f -exec rm --recursive --force --verbose "{}" \;
   RunasRoot rmdir --verbose "${TMPDIR}"

   PrintInfo "Switch to a local mirror by Geolocation/Timezone"
   RunasRoot pacman-mirrors --timezone
   RunasRoot pacman-mirrors --fasttrack 5

   AskForRefreshKeys

   AskForUpgrade

}

FixGPGmeERROR ()
{
  PrintInfo "Remove all Signatures at /var/lib/pacman/sync/"
  RunasRoot find /var/lib/pacman/sync/ -type f -name "*.sig" -exec rm --force --verbose "{}" \;
  
  PrintInfo "Remove all Signatures at /var/cache/pacman/pkg/"
  RunasRoot find /var/cache/pacman/pkg/ -type f -name "*.sig" -exec rm --force --verbose "{}" \;
  
  RmLockFiles
  
  PrintInfo "Refresh Package Database"
  RunasRoot pacman --sync --refresh --refresh

  AskForUpgrade
}

HelpPage ()
{
   printf "\n\t%s\n" "Method 1 - Basic"
   printf "\t%s\n" "1. Remove lock files of pamac and pacman"
   printf "\t%s\n" "2. Refresh Package Database"
   printf "\t%s\n" "3. Populate local keyrings to the GnuPG Database of pacman"
   printf "\t%s\n" "4. Refresh GnuPG Database of pacman from the Internet [optional]"
   printf "\t%s\n" "5. Performing a full upgrade with pacman [optional]"

   printf "\n\t%s\n" "Method 2 - Moderate"
   printf "\t%s\n" "1. Remove lock files of pamac and pacman"
   printf "\t%s\n" "2. Remove Pacman's GnuPG Database"
   printf "\t%s\n" "3. Initilize Pacman's GnuPG Database"
   printf "\t%s\n" "4. Populate local keyrings to Pacman's GnuPG Database"
   printf "\t%s\n" "5. Refresh GnuPG Database of pacman from the Internet [optional]"
   printf "\t%s\n" "6. Remove cached software packages [optional]"
   printf "\t%s\n" "7. Performing a full upgrade with pacman [optional]"

   printf "\n\t%s\n" "Method 3 - Aggressive"
   printf "\t%s\n" "1. Remove lock files of pamac and pacman"
   printf "\t%s\n" "2. Switch to global mirror (Manjaro's CDN)"
   printf "\t%s\n" "3. Remove Pacman's GnuPG Database"
   printf "\t%s\n" "4. Initilize Pacman's GnuPG Database"
   printf "\t%s\n" "5. Remove cached software packages"
   printf "\t%s\n" "6. Create a temporary folder in /tmp"
   printf "\t%s\n" "7. Copy /etc/pacman.conf to TMPDIR/pacman.conf and disable temporarily gpg verification."
   printf "\t%s\n" "8. Download the newest packages which contains the gpg keyrings in TMPDIR"
   printf "\t%s\n" "9. Install temporarily downloaded keyring packages"
   printf "\t%s\n" "10. Remove temporary directory TMPDIR"
   printf "\t%s\n" "11. Switch to a local mirror by Geolocation"
   printf "\t%s\n" "12. Refresh GnuPG Database of pacman from the Internet [optional]"
   printf "\t%s\n" "13. Performing a full upgrade with pacman [optional]"
   
   printf "\n\t%s\n" "Addition: Fix GPGme Errors"
   printf "\t%s\n" "1. Remove all Signatures at /var/lib/pacman/sync/"
   printf "\t%s\n" "2. Remove all Signatures at /var/cache/pacman/pkg/"
   printf "\t%s\n" "3. Remove lock files of pamac and pacman"
   printf "\t%s\n" "4. Refresh Package Database"
   printf "\t%s\n" "5. Performing a full upgrade with pacman"
    
   printf "\n\t%s\n\n" "Note: That tool is not designed to fix gpg issues with your local user GnuPG Database, which is commonly used for AUR Packages as an example."
}

HelpUsage () { printf '\e[32m%s\e[0m\n' "$0 [--usage|--help|--basic|--moderate|--aggressive|--fixgpgme|--ask] (default: [--basic])"; }

Menu ()
{
   clear
   while true; do
      printf '\e[33m%s\e[0m\n' "1. Basic"
      printf '\e[33m%s\e[0m\n' "2. Moderate"
      printf '\e[33m%s\e[0m\n' "3. Aggressive"
      printf '\e[33m%s\e[0m\n' "4. Addition: Fix GPGme Errors"
      printf '\e[33m%s\e[0m\n' "5. Explanations of the methods"
      printf '\n\e[33m%s\e[0m\n\n' "Type [q] to quit."
      PrintQuestion "Choose a Method by typing the number and press ENTER on your keyboard."
      read -p "[1,2,3,4,q]>  " choice
      case $choice in
         1) 
            BasicMethod && exit
         ;;
         2) 
            ModerateMethod && exit
         ;;
         3) 
            AggressiveMethod && exit
         ;;
         4)
            FixGPGmeERROR && exit
         ;;
         5)
            HelpPage && continue
         ;;
         q)
            exit
         ;;
         *)
            clear && PrintError "No valid answer. Continue." && continue ;;
      esac
   done
}

[[ -z $@ ]] && Menu && exit
case $1 in 
   --basic)
      BasicMethod && exit
   ;;
   --moderate)
      ModerateMethod && exit
   ;;
   --aggressive)
      AggressiveMethod && exit
   ;;
   --fixgpgme)
      FixGPGmeERROR && exit
  ;;
   --help)
      HelpUsage && HelpPage && exit
   ;;
   --usage)
      HelpUsage && exit
   ;;
   --ask)
      Menu && exit
   ;;
   *)
      PrintError "\"$1\" is not a valid parameter. See \"$0 --usage\""
   ;;
esac
###END###

You could run it like that:

# No argument/parameter will default to "--ask"
export FILE=$(curl -s "https://forum.manjaro.org/raw/125822" | sed -n -r '/^###START###$/,/^###END###$/p')
bash <(<<<"$FILE")
bash <(<<<"$FILE") --help
bash <(<<<"$FILE") --usage
bash <(<<<"$FILE") --ask
bash <(<<<"$FILE") --basic
bash <(<<<"$FILE") --moderate
bash <(<<<"$FILE") --aggressive
bash <(<<<"$FILE") --fixgpgme

This is a wiki article and you are invited to make the script better or add more explanations or anything else.

Owslicer · 6 September 2025 18:17

thank you so much I tried fixing the signatures using commands, and by fixing them manually, but it didn’t work then I used 1,2,and 3. I almost lost hope, but 3 fixed it. you’re the best