Artix Linux Forum

Artix Linux => Package management => Topic started by: Starbeamrainbowlabs on 16 October 2017, 19:45:06

Title: Invalid packages in the latest update
Post by: Starbeamrainbowlabs on 16 October 2017, 19:45:06
Hello,

I've just been updating my manjaro -> artix machine, and I've run into a bit of a problem: The libsodium and imagemagick packages don't want to update because their PGP signature is apparently invalid. Here's the complaint in full:

error: imagemagick: signature from "Cromnix (Buildbot) <cromnix@cromnix.org>" is invalid
:: File /var/cache/pacman/pkg/imagemagick-6.9.9.20-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: libsodium: signature from "Cromnix (Buildbot) <cromnix@cromnix.org>" is invalid
:: File /var/cache/pacman/pkg/libsodium-1.0.15-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: failed to commit transaction (invalid or corrupted package)

Thoughts? I don't really want to install them without a valid signature, as I believe that's a security risk.

(Also, the last "What's your favourite colour?" verification question whilst registering was rather confusing, and I ended up guessing!)

--Starbeamrainbowlabs
Title: Re: Invalid packages in the latest update
Post by: francesco on 16 October 2017, 20:21:29
You can find the answer in Announcements, [Re: New primary mirror] open from thefallenrat.  :D

Title: Re: Invalid packages in the latest update
Post by: thefallenrat on 21 October 2017, 10:06:52
This should have been fixed with the recent update. Please refresh the databse (-Syy) and re-update again.

Relevant topic : 

https://artixlinux.org/forum/index.php?topic=148.0
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 01 November 2017, 17:08:50
Code: [Select]
error: failed retrieving file 'yelp-tools-3.18.0+1+g193c2bd-2-any.pkg.tar.xz' from www.uex.dk : The requested URL returned error: 404
error: failed retrieving file 'yelp-tools-3.18.0+1+g193c2bd-2-any.pkg.tar.xz' from www.uex.dk : The requested URL returned error: 404
warning: failed to retrieve some files
error: failed to commit transaction (unexpected error)
Errors occurred, no packages were upgraded.


Is this a mirror error?
I have been away for a few days and just logged in and tried to update.  Even ignoring the pkg doesn't help,  No updates could be done.
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 01 November 2017, 17:23:27
Putting yelp-tools in pacman.conf as ignored-pkgs seems to free up the upgrade.
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 01 November 2017, 17:25:18
Code: [Select]
Synchronizing package databases...
Starting full system upgrade...

Warning: yelp-tools: ignoring package upgrade (3.18.0+1+g193c2bd-1 => 3.18.0+1+g193c2bd-2)
Resolving dependencies...
Checking inter-conflicts...
Downloading...
Downloading at-spi2-core-2.26.2-1-x86_64.pkg.tar.xz...
Checking keyring...
Checking integrity...
Error: at-spi2-core: signature from "Cromnix (Buildbot) <cromnix@cromnix.org>" is invalid

Failed to commit transaction:
invalid or corrupted package:
Title: Re: Invalid packages in the latest update
Post by: toxygen on 02 November 2017, 12:52:38
Quote
Error: at-spi2-core: signature from "Cromnix (Buildbot) <cromnix@cromnix.org>" is invalid
same here doing -Syu
Title: Re: Invalid packages in the latest update
Post by: artoo on 02 November 2017, 12:55:50
I fixed that.
Refresh your local repo dbs

Code: [Select]
pacman -Syyu
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 02 November 2017, 15:05:47
Solved!
Title: Re: Invalid packages in the latest update
Post by: physkets on 02 November 2017, 17:51:16
@artoo Any idea why that keeps happening to some packages?
Title: Re: Invalid packages in the latest update
Post by: artoo on 02 November 2017, 18:58:06
@artoo Any idea why that keeps happening to some packages?

Yes, we know what causes it, it is related to the build pipeline (https://github.com/artix-linux/system/blob/master/Jenkinsfile) and parsing the git changeset.There was also a bug on the jenkins plugin side that has been fixed by the jenkins devs.
In short, it happens, if the team push to a repo at the same time, and someone does has to do a pull again before he can push, because someone else pushed a wee bit earlier. This causes then a rebuild of already built packages, and they get signed again, and on the user end, this is what throws signature errors.
Title: Re: Invalid packages in the latest update
Post by: kbk on 08 November 2017, 00:50:03
I get this signature error this time with fzf, qutebrowser and udiskie

Code: [Select]

(134/134) checking package integrity                                                                                                    [###################################################################################] 100%
error: fzf: signature from "Ambrevar <ambrevar@gmail.com>" is unknown trust
:: File /var/cache/pacman/pkg/fzf-0.17.1-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: qutebrowser: signature from "Ambrevar <ambrevar@gmail.com>" is unknown trust
:: File /var/cache/pacman/pkg/qutebrowser-1.0.3-1-any.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: udiskie: signature from "Ambrevar <ambrevar@gmail.com>" is unknown trust
:: File /var/cache/pacman/pkg/udiskie-1.7.2-1-any.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.


how to solve it.
Title: Re: Invalid packages in the latest update
Post by: thefallenrat on 08 November 2017, 04:52:45
Code: [Select]
"Ambrevar <ambrevar@gmail.com>" is unknown trust

Refresh your arch's keyring
Code: [Select]
sudo pacman -Sy archlinux-keyring
sudo pacman-key --populate archlinux
sudo pacman-key --refresh-keys
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 12 November 2017, 09:37:06
Code: [Select]
libbytesize: signature from "Cromnix (Buildbot) <cromnix@cromnix.org>" is invalid

 unixodbc: signature from "Artix Buildbot <buildbot@artixlinux.org>" is invalid
:: File /var/cache/pacman/pkg/unixodbc-2.3.4-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).

 jemalloc: signature from "Artix Buildbot <buildbot@artixlinux.org>" is invalid
:: File /var/cache/pacman/pkg/jemalloc-1:5.0.1-3-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).

portaudio: signature from "Artix Buildbot <buildbot@artixlinux.org>" is invalid
:: File /var/cache/pacman/pkg/portaudio-190600_20161030-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).


I just repeated the above procedure that Falling Angel prescribes a few minutes ago.
Only the first error from Cromnix went away.
Title: Re: Invalid packages in the latest update
Post by: thefallenrat on 12 November 2017, 10:47:37
Sorry can't reproduce it ( Or maybe it has been fixed by other team member) :

Code: [Select]
world/jemalloc            1:5.0.1-3          1:5.0.1-3            0.00 MiB       0.27 MiB
galaxy-testing/portaudio  190600_20161030-1  190600_20161030-1    0.00 MiB       0.09 MiB
world-testing/unixodbc    2.3.4-2            2.3.4-2              0.00 MiB       0.21 MiB

Total Download Size:   0.57 MiB
Total Installed Size:  2.82 MiB
Net Upgrade Size:      0.00 MiB

:: Proceed with installation? [Y/n] y
:: Retrieving packages...
 unixodbc-2.3.4-2-x86_64                                                      219.0 KiB   178K/s 00:01 [------------------------------------------------------------] 100%
 jemalloc-1:5.0.1-3-x86_64                                                    272.9 KiB   800K/s 00:00 [------------------------------------------------------------] 100%
 portaudio-190600_20161030-1-x86_64                                            93.6 KiB   306K/s 00:00 [------------------------------------------------------------] 100%
(3/3) checking keys in keyring                                                                         [------------------------------------------------------------] 100%
(3/3) checking package integrity                                                                       [------------------------------------------------------------] 100%
(3/3) loading package files                                                                            [------------------------------------------------------------] 100%
(3/3) checking for file conflicts                                                                      [------------------------------------------------------------] 100%
(3/3) checking available disk space                                                                    [------------------------------------------------------------] 100%
:: Processing package changes...
(1/3) reinstalling unixodbc                                                                            [------------------------------------------------------------] 100%
(2/3) reinstalling jemalloc                                                                            [------------------------------------------------------------] 100%
(3/3) reinstalling portaudio                                                                           [------------------------------------------------------------] 100%

You may try to delete the faulty packages at first try and redo the pacman command again
Title: Re: Invalid packages in the latest update
Post by: fungalnet on 12 November 2017, 12:44:45
I retried it now and the problem is gone in all four.
And probably while I refreshed the db and keys someone fixed the 1st problem too.
If I can not reproduce my own problem with binary systems magic and lack are never a variable.
Meanwhile I tried a different pkg with different dependencies and it worked, so I ended up removing all but portaudio.

Thanks fallenrat