Issues with "signature is marginal trust" or "invalid or corrupted package"

faq

#21

Essentially the same thing. However, some mirrors go offline or stop syncing entirely. Check repo.manjaro.org for the status of the mirror you’re using.

I don’t know what method you’re using for this, but you should either be using a reliable mirror, or regularly refreshing your mirror list.

Mirror lists will only be automatically updated on an update of the pacman-mirrors package, and only if you haven’t disabled that in /etc/pacman-mirrors.conf. PGP signatures will only be updated on an update of archlinux-keyring and manjaro-keyring.

If you have a mirror that has synced extra or community but not core then you can end up with packages signed by an unknown key, and no update to either keyring package. This is one potential reason for the issue you first posted in this thread.

Regarding the second issue you posted, if things work sometimes, or they didn’t work before but do now, this is more than likely because the particular mirror you were using was out-of-date. This may or may not be a partially-synced mirror.

There isn’t only one, isolated, reason why packages show a key error that can be fixed with a single command or change to the current infrastructure or process.


#22

Thanks.
Now I think I understand it.
Basically, as a simple user, we can’t do anything with this “bug”, or better to call it not a bug, rather a flaw in the system, If I’m getting your words right…

So, whoever maintain the mirror is the one who -theoretically- cause this flaw?
And if I’m really want to eliminate this, I have to try the impossible; contact the maintainers of that particular mirror and tell them the problem?

P.S.:According to this page; Mirrors, I’m sure I always use official mirrors.


#23

3 posts were split to a new topic: Can’t install new package with old keyring installed


#24

I know this is a bit old but FYI and for others after you - I have this comment to the issue.

If you run into a partially updated mirror - you have probably caught it in the middle of a large sync process - which hardly can be called an error on the mirrors site :slight_smile:

But you should know that if you have a custom mirror file then you have a limitation on your mirror pool with the possibility of no mirrors not being up-to-date. You probably know if you have customized your mirror pool :slight_smile: but you can verify by looking for custom-mirrors.json in /var/lib/pacman-mirrors

ls /var/lib/pacman-mirrors

If you want to ensure you pull your updates from a mirror fully up-to-date for your branch I recommend using a command sequence like the following examples when you update your system.

  • When no custom mirror file exist

    sudo pacman-mirrors --fasttrack && sudo pacman -Syyu

  • When custom mirror file exit - reset the list and probe all mirrors

    sudo pacman-mirrors --country all && sudo pacman -Syyu

We slice out the pacman -Syyu command and explain what it does

  • S is install packages
  • yy
    • first y is a flag to check databases and download if changed
    • second y is a flag to download databases even if they have not changed
  • u is a flag to update the system

#27

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.