[Unstable Update] January 2025

[cscs]

This one.

[root tip] [How To] Mitigate and prevent GPGME error when syncing your system

You are getting a message when syncing your system error: GPGME error: No data error: failed to synchronize all databases (invalid or corrupted database (PGP signature)) Before you continue [SOLVED] Error updating system (error: GPGME error: No data) / Newbie Corner / Arch Linux Forums Pacman troubleshooting - Manjaro Pacman looking for database signature files Also see this pacman bugreport from 2015 - which was closed as not a bug but a matter of configuration. FS#44445 : "GPGME err…

Used to suggest

SigLevel    = Optional DatabaseNever

But has since been edited to suggest

SigLevel    = Required DatabaseNever

But there are still an untold number of threads and users with the suggestion in one way or another to disable the signatures.

Such as here:

to look like this:
SigLevel = Optional TrustAll

Unable to update my system due to signing key errors

so go open again /etc/pacman.conf and edit this line: SigLevel = Required DatabaseOptional to look like this: SigLevel = Optional TrustAll then run these: sudo rm -f /var/lib/pacman/sync/* sudo pacman-mirrors --continent sudo pacman-mirrors --api --protocol https sudo pacman -Scc sudo pacman -Syyu

I just meant that anyone who has followed such advice or for whatever reason has lesser SigLevel options applied would be vulnerable to an exploited mirror.

For a while at least one of the most common responses to ‘Trouble syncing packages, errors about keys’ on the forums was to augment the SigLevel options to something more permissive. That always meant lesser security, but this news makes a tangible argument for why not to.