Pacman: Signature is invalid

Hi all,

as the title says, I regularly run into this issue with Pacman where I’m unable to update my system. It usually looks like this:

error: cachyos-extra-v3: signature from "CachyOS <admin@cachyos.org>" is invalid
:: Synchronising package databases...
 cachyos-v3                                                                                                                                    190.5 KiB  7.15 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 cachyos-core-v3                                                                                                                                90.1 KiB  3.03 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 cachyos-extra-v3                                                                                                                             1509.5 KiB  33.5 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 cachyos                                                                                                                                       488.5 KiB  9.94 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 core                                                                                                                                          117.7 KiB  3.48 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 extra                                                                                                                                           7.5 MiB  64.5 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
 multilib                                                                                                                                      133.8 KiB  2.97 MiB/s 00:00 [----------------------------------------------------------------------------------------------------------] 100%
error: cachyos-extra-v3: signature from "CachyOS <admin@cachyos.org>" is invalid
error: failed to synchronize all databases (unexpected error)

Sometimes it also is a db error instead of just an unexpected error. I searched the forums and none of the solutions work.

“Remove db lock” just says “Pacman db lock does not exist!”, “Refresh keyrings” returns some errors:

==> ERROR: The keyring file /usr/share/pacman/keyrings/libgnome.gpg does not exist.
==> ERROR: The keyring file /usr/share/pacman/keyrings/python-proton-linux.gpg does not exist.
==> ERROR: The keyring file /usr/share/pacman/keyrings/python-proton-linux-secretservice.gpg does not exist.

which I think are probably related to AUR packages and not the cause for these problems.

I tried other things like sudo pacman -Scc, sudo pacman -Syy, or sudo pacman -Sy archlinux-keyring. Every time something different might work, or the issue just goes away after some time. What is the cause, how can I fix it, and why is this happening so regularly? I’m talking multiple times a week on my end.

They all look related to protonvpn, can you temporarily un-install protonvpn to check if the errors are gone first.

Well yes, the refresh keyrings errors obviously get solved by that. But as I said, they don’t fix the signature issue from the CachyOS repos, since that’s rather an issue stemming from these packages being installed from the AUR.

I have no issues with mine:

 paru  protonvpn|grep Installed
1 aur/proton-vpn-gtk-app 4.5.0-1 [+75 ~17.94] [Installed]
2 aur/protonvpn-cli-community 2.2.12-1 [+9 ~0.67] [Installed]
3 aur/protonvpn-applet 0.1.7-1 [+3 ~0.00] [Installed]

Does running pacman with “–debug” tell you anything?

That’s weird, I just reinstalled proton-vpn-gtk-app from the AUR and the errors when running refresh keyrings are back. Did you also install those with paru, just in case the keyrings aren’t being handled correctly?

Sadly (or luckily I guess), the error is gone again, so I can’t really debug much any more. However, it is suspicious that I get this error for the core, extra, and multilib repo:

debug: registering sync database 'core'
debug: database path for tree core set to /var/lib/pacman/sync/core.db
debug: "/var/lib/pacman/sync/core.db.sig" is not readable: No such file or directory
debug: sig path /var/lib/pacman/sync/core.db.sig could not be opened
debug: got error 43 at _alpm_gpgme_checksig (../lib/libalpm/signing.c: 599) : missing PGP signature
debug: missing optional signature
debug: setting usage of 15 for core repository

However, Pacman is running fine, so not sure if these are even issues.

Edit: Just so we’re on the same page. When you run the “Refresh keyrings” script in the CachyOS Hello application, you get no errors whatsoever, right?

I would be safe in saying that I use “paru” for 95% of all my installs

ProtonVPN was very nice when they maintained it in (AUR), now it’s kind of hit and miss.
Just saw this:

I’m not a GUI type, 99% CLI, I can try though to check against what you see now.

I just confirmed on my other device and I see the same errors. So I think this is an issue with the AUR package.

I’m not a GUI type, 99% CLI, I can try though to check against what you see now.

Me neither, but this keyrings script is what the CachyOS staff recommended in other blog posts when having issues with the CachyOS certificate, which is why I tried it. Other than this script, the apparent lack of keyring files for the Proton VPN packages has caused me no issues so far.

Double confirm:

==> ERROR: The keyring file /usr/share/pacman/keyrings/python-proton-linux.gpg does not exist.
==> ERROR: The keyring file /usr/share/pacman/keyrings/python-proton-linux-secretservice.gpg does not exist.
Press enter to exit

They need to look at this, good find @RayJW

Well, since my original issue has been resolved (for now) all I can do is wait for it to happen again rather sooner than later probably. Thanks anyway for your help, and maybe someone else knows how to fix the CachyOS certificate issue reliably for the future.

Not sure whether this keyring problem should be reported to the AUR package, or if it’s rather a CachyOS issue. The package is quite popular on the AUR, so it would be weird that no one else has caught it yet. I didn’t see anyone reporting something that looks related.

I can confirm as a Regular Arch user, Ive not seen this on any other Install outside of CachyOS

sudo pacman-key --populate
[sudo] password for me: 
==> Appending keys from archlinux.gpg...
==> Appending keys from cachyos.gpg...
==> Updating trust database...
gpg: next trustdb check due at 2024-11-09

Please try those commands in terninal @1fallen @RayJW

sudo pacman-key --refresh-keys
sudo pacman -Sy

No need for me I’m all good here. Good Try though :slight_smile:

Oh, Scratch that then ! lol

Edit: I taught that you had the same issue, my bad.

No Worries @altman :slight_smile:
Only when the Hello app is used, but as I said I’m a CLI type.

I live by this motto: “Live by the GUI Die by the GUI” they are just front ends to commands anyway…

Yep, I m more used to Terminal commands, but Cachy OS Hello s pretty neat I must say, maybe @RayJW can alsotry to update Keys from the GUI.

No need for me I’m all good here. Good Try though :slight_smile:

Same, since the original error with the CachyOS repos has once again resolved itself. I will try that the next time I run into this issue though :slight_smile:

sudo pacman-key --refresh-keys did apparently change a bunch of keys, but the keyring issue with the proton-vpn packages are still unchanged.

Edit:

Yep, I m more used to Terminal commands, but Cachy OS Hello s pretty neat I must say, maybe @RayJW can alsotry to update Keys from the GUI.

The same goes for me, I only used the GUI because that’s what the CachyOS developers said to use when having issues with the repos and it didn’t help hence this post.

Ok, what the 2nd command s output is @RayJW , can you post results also .

sudo pacman -Sy

Just the regular synchronizing repos and nothing to update, since the original issue is already fixed for now.

Hey cool, hope all s well now.

As for Proton s issues, I think it might not be synced somehow.

It definitely is for now, but as I stated in the original post the problem regularly returns and that’s why I wanted to see if anyone has the same problem or a reliable fix for the problem.

1 Like