Pacman -Syu failed but pamac succeeded, why?

[bendipa1]

I decided to re-install Manjaro to KDE version. I had been using Xfce. The installation went ok. I then decided to update Manjaro using command above. This seemed to proceed just fine, but after downloading 600 packages I was then told I had a corrupted GPG signature and the update was abandoned. I tried a 2nd time on this occasion telling pacman to delete offending GPG sig when offered, and the same thing happened again.

But here’s the thing. I decided to update via the pamac GUI instead as a last try before investigating this further. As it turned out the whole update proceeded without further ado, and I’m happily updated. So why did the pacman command fail, which I’ve used countless times before when updating?

[ben75]

If you installed from an older ISO, its keyring files may be outdated. In this case, it is best to upgrade archlinux-keyring and manjaro-keyring before upgrading any other packages.

[Teo]

This actually has to happen automatically, it is the default and configured in pacman.conf.

Otherwise i have no idea why pacman failed and pamac worked. Maybe something was cached…
Next time, keep the log.

[Aragorn]

@Teo

This actually has to happen automatically, it is the default and configured in pacman.conf.

Yes, but if one does not refresh one’s mirrors before running a bundled update, then some of the mirrors in the local list may still be in the process of syncing, and then you can run into this sort of problems. And in this case, apparently the lagging mirror(s) had apparently finished syncing by the third attempt.

The clue is of course to always refresh one’s mirror list before applying a bundled update.

[Ben]

@bendipa1

So why did the pacman command fail, which I’ve used countless times before when updating?

The core problem is the corrupt/outdated Arch Linux Keyring (so likely an older ISO). Generally, when I boot an ISO, I’d download a fresh one to install.

Corrupt GPG signatures => archlinux-keyring package… you installed a KDE version with a snapshot of the archlinux-keyring from that release date.

• pacman is superb, but it’s also a very basic “do exactly as you’re told” - It’s a SHARP tool, not a fuzzy one…

Then your second attempt --delete says ‘ignore the signature and delete the file’; but the next package is signed with another key you don’t have…

• pamac is a more sophisticated manager with a bit of extra logic and convenience; so it often handles your keyring updates as a separate, automatic step.

So pamac likely sees the keyring issue and updated archlinux-kering first; which is signed with a master key, so your system still trusts that.

Then with a new set of keys, it updates your other stuff with no signature errors.

The correct way to deal with this:

sudo pacman -Sy archlinux-keyring manjaro-keyring
sudo pacman -Syu

Edit: Updated - include manjaro-keyring (sorry, forgot).

[bendipa1]

@Ben

@bendipa1

So why did the pacman command fail, which I’ve used countless times before when updating?

The core problem is the corrupt/outdated Arch Linux Keyring (so likely an older ISO). Generally, when I boot an ISO, I’d download a fresh one to install.

Corrupt GPG signatures => archlinux-keyring package… you installed a KDE version with a snapshot of the archlinux-keyring from that release date.

• pacman is superb, but it’s also a very basic “do exactly as you’re told” - It’s a SHARP tool, not a fuzzy one…

@bendipa1

Well it would seem likely a keyring issue. I installed from the ISO which was KDE Plasma v. 6.3.6, kernel v. 6.12.48.1, so not the most recent one. Still, I would have expected updating keyrings to be part of the pacman installation process. Eg I installed Endeavouros recently, and the first thing you see in the ‘installing stage’ info bar shown at the bottom of the screen is the update/installation of keyrings.

@Ben

Then your second attempt --delete says ‘ignore the signature and delete the file’; but the next package is signed with another key you don’t have. pamac is a more sophisticated manager with a bit of extra logic and convenience; so it often handles your keyring updates as a separate, automatic step.

@bendipa1

[BIB] - Is that a fact or belief?

@Ben

So pamac likely sees the keyring issue and updated archlinux-kering first; which is signed with a master key, so your system still trusts that. Then with a new set of keys, it updates your other stuff with no signature errors. The correct way to deal with this: sudo pacman -Sy archlinux-keyring and sudo pacman -Syu

@bendipa1

So in essence, you’re saying that pamac likely deals with keyrings automatically on a big upfate whereas with pacman you have to manually use that first command to set up keyrings before the main update itself? I suppose the vast majority of new users would head for the pamac GUI anyway to update rather than try the pacman commands.

…

[dmt]

@bendipa1

whereas with pacman you have to manually use that first command to set up keyrings before the main update itself?

Only when there’s an issue with the keyring. pacman normally updates the keyring for you, but if there’s an issue then it’s up to you to sort it out.

However it is recommended as a preventative if you haven’t updated in a while.

Upgrading the system regularly via pacman#Upgrading packages prevents most signing errors. If delay is unavoidable and system upgrade gets delayed for an extended period, manually sync the package database and upgrade the archlinux-keyring package before system upgrade

pacman/Package signing - ArchWiki

pacman - ArchWiki

[bendipa1]

Well I tried a fresh install again using same ISO for KDE Plasma 6.3.6, and when finished applied command sudo pacman -Sy archlinux-keyring. This seemed to update/add new keyrings, but when I ran sudo pacman -Suy, again it downloaded all 680 updates, but then aborted with:- File /var/cache/pacman/pkg/pacman-mirrors-5.3-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)), so same issue as before.

However running pamac update again prevented any signature issues. The process for checking key integrity under pamac showed as:

Upgrading manjaro-keyring (20230719-3 -> 20251003-1)...                                                                                                                                 [1/1]
==> Appending keys from manjaro.gpg...
==> Locally signing trusted keys in keyring...
  -> Locally signed 4 keys.
==> Importing owner trust values...
gpg: setting ownertrust to 4
==> Disabling revoked keys in keyring...
  -> Disabled 1 key.
==> Updating trust database...
gpg: Note: third-party key signatures using the SHA1 algorithm are rejected
gpg: (use option "--allow-weak-key-signatures" to override)
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:  22  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:  22  signed: 103  trust: 0-, 0q, 0n, 22m, 0f, 0u
gpg: depth: 2  valid:  76  signed:  19  trust: 76-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2026-01-30
Resolving dependencies...
Checking inter-conflicts...
Checking keyring...                                                                                                                                                                 [678/678]
Checking integrity.  [678/678]

So it seems that pamac is the way to go for a fresh installation.

[ben75]

@bendipa1

sudo pacman -Sy archlinux-keyring

should be

sudo pacman -Sy archlinux-keyring manjaro-keyring

This will update all necessary keyring files before an update.

[Ben]

@ben75

This will update all necessary keyring files before an update.

Whoops, my bad - updated the post now.