Unable to update (key issues / corrupted packages)

megavolt · 30 November 2021 14:10

Have look at this section of the Wiki: Errors about Keys (which was already mentioned by @alven in his suggestion)

What was not mentioned:

KEEP SURE THAT THE TIME/DATE IS SET CORRECTLY

If the system date or time is set wrong at the time of running these commands, then also the signatures are invalid. That could also happen on Dual-Boots with Windows.

Checklist:

Date/Time have to be correct.
Mirror have to be updated and not corrupted.
Stable internet connection.

Anything else has been said already.

More explanation:

Keep sure the date is set correctly

This removes all used signatures:

sudo rm -r /etc/pacman.d/gnupg

Now you need to generate a master key for pacman:

sudo pacman-key --init

Now you need to import the keys for packages:

sudo pacman-key --populate archlinux manjaro

But if the installed keyrings are too old, then they are invalid. Download them manually from a mirror and install them like that:

sudo pacman -U *.tar.zst

When installing the packages it should also populate the keys.

I checked it myself. The main part what went wrong here must be that the keys changed. You must download the current keyrings and import/populate them. Since the keyrings packages are also signed, it can only be done manually at this point or by lowering the security level at the pacman.conf.

Note: The section on the wiki needs to be improved…

alven · 30 November 2021 14:32

Just to add possible issue case

You can have visually accurate time, but it could be not correct.

For example, you live in Switzerland, which timezone is:

Time zone	UTC+1 (CET)
• Summer (DST)	UTC+2 (CEST)
But on local PC you might setup the another - say `UTC+0` - time zone and than to manually shift the clock for +1 or +2 hours to correct another timezone time selected before.
That will produce a time issue.

Once upon a time I made an delivery order on a website in web browser by choosing the certain delivery time, say 12:00. By that time and a bit later I did not receive the order and made a phone call to company in 12:30. They said that I ordered by time 15:00, but not by 12:00. The issue was originated that I was not having correct time zone and shift real timezone time manually to be visually correct for me and was having -3 hours shift in my local PC timezone.

Perfectly if you will sync both time and timezone via Internet in OS settings and than manually re-check time zone and time afterwards.

saintjules · 30 November 2021 14:36

Hi @megavolt , thanks for your input!

Date seems correct. Italy is in daylight saving zone, would that be a problem? How do I doulble-check I don’t have time issues?

2021-11-30 15:31:49.358222+01:00

I like the idea of manually downloading the keyringer… though, to be honest, I succeeded in updating just yesterday. So how do I verify archlinux-keyringer? Can I download and import the signature from the repo?

Same problem here:

:: Import PGP key 6D42BDD116E0068F, "Christian Hesse <arch@eworm.de>"? [Y/n] y
error: 'archlinux-keyring-20211028-1-any.pkg.tar.zst': invalid or corrupted package (PGP signature)

megavolt · 30 November 2021 14:48

As mentioned:

Remove pacmans gnupg.
generate the master key
Now important:

Remove all files in the cache:

sudo rm -f /var/cache/pacman/pkg/*

Update the database and download only the packages:

sudo pacman -Syw archlinux-keyring manjaro-keyring

Remove the signatures:

sudo rm -f /var/cache/pacman/pkg/*.tar.zst.sig

Install the packages manually:

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst

(should be only these 2 packages)

Now it should work normally again.

saintjules · 30 November 2021 14:52

Sorry, but this command always gives me the same old error about the PGP signature.

megavolt · 30 November 2021 14:53

No worry, it will still downloads the packages… it just failed to check the signature. It is harmless…

saintjules · 30 November 2021 15:12

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst
loading packages...
warning: archlinux-keyring-20211028-1 is up to date -- reinstalling
warning: manjaro-keyring-20210910-2 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...

Packages (2) archlinux-keyring-20211028-1  manjaro-keyring-20210910-2

Total Installed Size:  1,53 MiB
Net Upgrade Size:      1,36 MiB

:: Proceed with installation? [Y/n] y
(2/2) checking keys in keyring                                            [##########################################] 100%
(2/2) checking package integrity                                          [##########################################] 100%
(2/2) loading package files                                               [##########################################] 100%
(2/2) checking for file conflicts                                         [##########################################] 100%
error: failed to commit transaction (conflicting files)
archlinux-keyring: /usr/share/pacman/keyrings/archlinux-revoked exists in filesystem
archlinux-keyring: /usr/share/pacman/keyrings/archlinux-trusted exists in filesystem
archlinux-keyring: /usr/share/pacman/keyrings/archlinux.gpg exists in filesystem
Errors occurred, no packages were upgraded.

Nothing has changed. Still I can’t install any new package.

megavolt · 30 November 2021 15:20

Well then I assume the that the keyrings are the current ones… good.

It is possible that the keyrings are corrupted somehow…

To overwrite the paths:

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst --overwrite /usr/share/pacman/keyrings/

or

sudo pacman -R archlinux-keyring manjaro-keyring

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst

Then follow the sequence without installing the packages:

megavolt:

This removes all used signatures:
sudo rm -r /etc/pacman.d/gnupg
Now you need to generate a master key for pacman:
sudo pacman-key --init
Now you need to import the keys for packages:
sudo pacman-key --populate archlinux manjaro

Please post all outputs here.

saintjules · 30 November 2021 17:02

sudo pacman -R archlinux-keyring manjaro-keyring
[sudo] password for giulio: 
checking dependencies...
error: failed to prepare transaction (could not satisfy dependencies)
:: removing archlinux-keyring breaks dependency 'archlinux-keyring' required by pacman
:: removing manjaro-keyring breaks dependency 'manjaro-keyring' required by pacman

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst
loading packages...
warning: archlinux-keyring-20211028-1 is up to date -- reinstalling
warning: manjaro-keyring-20210910-2 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...

Packages (2) archlinux-keyring-20211028-1  manjaro-keyring-20210910-2

Total Installed Size:  1,53 MiB
Net Upgrade Size:      1,36 MiB

:: Proceed with installation? [Y/n] n

sudo pacman-key --init
gpg: /etc/pacman.d/gnupg/trustdb.gpg: trustdb created
gpg: no ultimately trusted keys found
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/etc/pacman.d/gnupg/secring.gpg' to gpg-agent
gpg: migration succeeded
==> Generating pacman master key. This may take some time.
gpg: Generating pacman keyring master key...
gpg: key 075D87103B8C655A marked as ultimately trusted
gpg: directory '/etc/pacman.d/gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/etc/pacman.d/gnupg/openpgp-revocs.d/E58E5D3F2BE5BA91B7F9F0B5075D87103B8C655A.rev'
gpg: Done
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u

sudo pacman-key --populate archlinux manjaro
==> Appending keys from archlinux.gpg...
gpg: no valid OpenPGP data found.
==> Appending keys from manjaro.gpg...
gpg: error reading key: No public key
gpg: error reading key: No public key
==> Locally signing trusted keys in keyring...
  -> Locally signed 22 keys.
==> Importing owner trust values...
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
==> Disabling revoked keys in keyring...
  -> Disabled 3 keys.
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:  22  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:  22  signed:   1  trust: 0-, 0q, 0n, 22m, 0f, 0u
gpg: next trustdb check due at 2022-04-20

Is this supposed to have changed anything? I’m still stuck.

saintjules · 30 November 2021 17:04

btw, the correct command is pacman-key

alven · 30 November 2021 17:15

megavolt helped a lot of people already, may be sometimes typos could be, I think you fixed the command correctly.

I noted that the

was not executed. Or just did not post it yet?

If your target action is to fix the issue according to megavolt’s suggestion, then why to stop at this point?

saintjules · 30 November 2021 17:31

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst --overwrite /usr/share/pacman/keyrings/
loading packages...
warning: archlinux-keyring-20211028-1 is up to date -- reinstalling
warning: manjaro-keyring-20210910-2 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...

Packages (2) archlinux-keyring-20211028-1  manjaro-keyring-20210910-2

Total Installed Size:  1,53 MiB
Net Upgrade Size:      1,36 MiB

:: Proceed with installation? [Y/n] y
(2/2) checking keys in keyring                                            [##########################################] 100%
(2/2) checking package integrity                                          [##########################################] 100%
(2/2) loading package files                                               [##########################################] 100%
(2/2) checking for file conflicts                                         [##########################################] 100%
error: failed to commit transaction (conflicting files)
archlinux-keyring: /usr/share/pacman/keyrings/archlinux-revoked exists in filesystem
archlinux-keyring: /usr/share/pacman/keyrings/archlinux-trusted exists in filesystem
archlinux-keyring: /usr/share/pacman/keyrings/archlinux.gpg exists in filesystem
Errors occurred, no packages were upgraded.

I thought @megavolt said “without installing the packages”. But, as you can see from the output above, proceeding with the installation doesn’t change anything.

megavolt · 30 November 2021 17:35

hammer and nail method:

sudo rm /usr/share/pacman/keyrings/archlinux*

sudo pacman -U /var/cache/pacman/pkg/*.tar.zst

saintjules · 30 November 2021 17:39

loading packages...
warning: archlinux-keyring-20211028-1 is up to date -- reinstalling
warning: manjaro-keyring-20210910-2 is up to date -- reinstalling
resolving dependencies...
looking for conflicting packages...

Packages (2) archlinux-keyring-20211028-1  manjaro-keyring-20210910-2

Total Installed Size:  1,53 MiB
Net Upgrade Size:      1,36 MiB

:: Proceed with installation? [Y/n] y
(2/2) checking keys in keyring                                            [##########################################] 100%
(2/2) checking package integrity                                          [##########################################] 100%
(2/2) loading package files                                               [##########################################] 100%
(2/2) checking for file conflicts                                         [##########################################] 100%
(2/2) checking available disk space                                       [##########################################] 100%
:: Processing package changes...
(1/2) reinstalling archlinux-keyring                                      [##########################################] 100%
==> Appending keys from archlinux.gpg...
==> Locally signing trusted keys in keyring...
  -> Locally signed 6 keys.
==> Importing owner trust values...
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: inserting ownertrust of 4
gpg: setting ownertrust to 4
==> Disabling revoked keys in keyring...
  -> Disabled 44 keys.
==> Updating trust database...
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10
gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10
gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:  28  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:  28  signed:  84  trust: 0-, 0q, 0n, 28m, 0f, 0u
gpg: depth: 2  valid:  79  signed:  26  trust: 79-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2022-01-20
==> Updating trust database...
gpg: next trustdb check due at 2022-01-20
(2/2) reinstalling manjaro-keyring                                        [##########################################] 100%
==> Appending keys from manjaro.gpg...
gpg: error reading key: No public key
gpg: error reading key: No public key
==> Disabling revoked keys in keyring...
  -> Disabled 2 keys.
==> Updating trust database...
gpg: next trustdb check due at 2022-01-20
:: Running post-transaction hooks...
(1/1) Arming ConditionNeedsUpdate...

OMG, looks like it worked! I’ve just successfully installed a new package!
Now what??

alven · 30 November 2021 17:42

Whoooooaaaaa!

As most egoist in the community I penetrate into the talk: I need you to show us the output of the:

sudo pacman-key -l | wc -l

and

sudo pacman-key -l 5F7078DF1E0FDF8745D5B984108E0767D5F34DE4 86CFFCA918CF3AF47147588051E8B148A9999C34 02FD1C7A934E614545849F19A6234074498E9CEE 39F0EC1AE50B37E5F3196F09DAD3B211663CA268

saintjules · 30 November 2021 17:45

1041

pub   rsa2048 2015-07-12 [SC]
      39F0EC1AE50B37E5F3196F09DAD3B211663CA268
uid           [  full  ] Bernhard Landauer <oberon@manjaro.org>
sub   rsa2048 2015-07-12 [E]
sub   dsa2048 2015-10-01 [S]

pub   rsa2048 2011-08-12 [SC]
      02FD1C7A934E614545849F19A6234074498E9CEE
uid           [marginal] Christian Hesse <eworm@archlinux.org>
uid           [  full  ] Christian Hesse (Arch Linux Package Signing) <arch@eworm.de>
sub   rsa2048 2011-08-12 [E]
sub   ed25519 2019-08-29 [S]
sub   cv25519 2019-08-29 [E]

pub   rsa2048 2010-11-12 [SC]
      86CFFCA918CF3AF47147588051E8B148A9999C34
uid           [  full  ] Evangelos Foutras <evangelos@foutrelis.com>
uid           [  full  ] Evangelos Foutras <foutrelis@gmail.com>
uid           [  full  ] Evangelos Foutras <foutrelis@archlinux.org>
sub   rsa2048 2010-11-12 [E]

megavolt · 30 November 2021 17:45

Now you have honorary task to pay me my well-deserved pizza just a joke

It should be done.

alven · 30 November 2021 17:46

HOOOORRAAAAAYY!!!
WE DID THE MAIN PART AT LAST! Not all but main part!

That’s how mega voltage works!

alven · 30 November 2021 17:47

Now please do steps 4 and 5 from the Pacman troubleshooting - Manjaro
By that actions you will add several keys and refresh all you have now

saintjules · 30 November 2021 17:50

You sir are a tresure! Thank you so much.
Now, maybe for future reference’s sake and for my own peace of mind:

What was the right path in the end?
How the hell do I keep this mess from happening again?