pacman: ... is corrupted (invalid or corrupted package (PGP signature)). after update.

[derram]

Need to update the keyring to fix this issue:

sudo pacman-key --init
sudo pacman -S archlinux-keyring 
sudo pacman-key --populate archlinux

[Leyn]

EDIT: found solution for "signature from GitLab is unknown trust" on next post

Hey, I did this after

sudo steamos-readonly disable

following https://www.reddit.com/r/SteamDeck/comments/wqd543/any_workarounds_for_steam_decks_readonly/, but I still get the error after your steps. More exactly:

$ sudo pacman-key --init
seems to work. The first time, it printed:

gpg: /etc/pacman.d/gnupg/trustdb.gpg: trustdb created
gpg: no ultimately trusted keys found
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/etc/pacman.d/gnupg/secring.gpg' to gpg-agent
gpg: migration succeeded
==> Generating pacman master key. This may take some time.
gpg: Generating pacman keyring master key...
gpg: directory '/etc/pacman.d/gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/etc/pacman.d/gnupg/openpgp-revocs.d/[SOME HEXA].rev'
gpg: Done
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u

The second time, it prints nothing, probably as nothing to do.

$ sudo pacman -S archlinux-keyring
will fail because of the very error we are trying to fix:

...
:: Proceed with installation? [Y/n] y  
(1/1) checking keys in keyring                                     [####################################] 100%  
(1/1) checking package integrity                                   [####################################] 100%  
error: archlinux-keyring: signature from "GitLab CI Package Builder <[e-mail]>" is unknown trust  
:: File /var/cache/pacman/pkg/archlinux-keyring-20230504-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).  
Do you want to delete it? [Y/n]

So I just went on with the 3rd instruction:

$ sudo pacman-key --populate archlinux
seems to work:

==> Appending keys from archlinux.gpg...
==> Locally signing trusted keys in keyring...
  -> Locally signed 5 keys.
==> Importing owner trust values...
gpg: setting ownertrust to 4
...
==> Disabling revoked keys in keyring...
  -> Disabled 33 keys.
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   5  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   5  signed:  79  trust: 0-, 0q, 0n, 5m, 0f, 0u
gpg: depth: 2  valid:  58  signed:  23  trust: 58-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2024-04-10

But then when I try to install anything, I got the same errors as before:

$ sudo pacman -S base-devel
resolving dependencies...
looking for conflicting packages...

Packages (16) autoconf-2.71-4  automake-1.16.5-2  ...  base-devel-1-1

Total Installed Size:  216.44 MiB

:: Proceed with installation? [Y/n] y
(16/16) checking keys in keyring                                   [####################################] 100%
(16/16) checking package integrity                                 [####################################] 100%
error: m4: signature from "GitLab CI Package Builder <[e-mail]>" is unknown trust
:: File /var/cache/pacman/pkg/m4-1.4.19-3-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]

This prevents me from installing any package and, in a vicious circle, also to use any workaround that relies on install via pacman.

The reddit thread mentions a few alternatives (Homebrew on Linux - but standard install uses pacman), while this post "PSA: WARNING ⚠️ Arch Linux Repos" https://steamcommunity.com/app/1675200/discussions/0/3395176266124615154/ mentions a few other ones (rwfus for Read-Write OverlayFS to install packages elsewhere - this one can be installed directly after cloning repository, without pacman, nice) which may even be better as they'd avoid wiping all my installed packages on next SteamOS update - but I'd still like to make pacman just work so I can test it a bit and see if it's worth going on further with SteamOS as a dev platform.

Should I just clean up the whole keyring? And if so, how? (and how not to get the same error again since I would just recreate the keyring the same way...)

[Leyn]

OK, so I tried to follow "Resetting all the keys" on:
https://wiki.archlinux.org/title/Pacman/Package_signing
but even after that, the error came back.

However, I found this other thread which tackles the GitLab key error specifically:
SteamOS 3.5.5: can't install pacman packages because of unknown trust
https://steamcommunity.com/app/1675200/discussions/0/7529517132619672170/
and is more recent (2023) and they recognized that something broke since the other 2022 thread's instructions. Besides `pacman-key --populate archlinux`, they added:

pacman-key --populate holo

which must add keys for packages build on GitLab specifically for SteamOS. And now it works! I could install packages like base-devel, and the rest should follow.

Even better, I can now also apply 3rd party solutions like Homebrew on Linux that are installed via pacman (so I can store packages in custom path and not have them overwritten on next system update).

[usamaizm]

引用自 Leyn：

OK, so I tried to follow "Resetting all the keys" on:
https://wiki.archlinux.org/title/Pacman/Package_signing
but even after that, the error came back.

However, I found this other thread which tackles the GitLab key error specifically:
SteamOS 3.5.5: can't install pacman packages because of unknown trust
https://steamcommunity.com/app/1675200/discussions/0/7529517132619672170/
and is more recent (2023) and they recognized that something broke since the other 2022 thread's instructions. Besides `pacman-key --populate archlinux`, they added:

pacman-key --populate holo

which must add keys for packages build on GitLab specifically for SteamOS. And now it works! I could install packages like base-devel, and the rest should follow.

Even better, I can now also apply 3rd party solutions like Homebrew on Linux that are installed via pacman (so I can store packages in custom path and not have them overwritten on next system update).

You are a G.