I'm getting an 'invalid or corrupted package (PGP signature)' error which is preventing updates

[Isaac]

My updates are getting stuck on polkit-0.119-1-x86_64. The error message is

error: polkit: signature from "Jonas Witschel <diabonas@gmx.de>" is unknown trust
File /var/cache/pacman/pkg/polkit-0.119-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]

I chose the default Y, then get

error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.

I can’t find any reports of this error. I did find a suggestion in a related error to replace the keyrings, but I’d want to know what’s gone wrong first, if possible.

pacman -Q archlinux-keyring gives archlinux-keyring 20210110-1, in case that helps.

Thanks

[keybreak]

Welcome!

You’ll find an answer how to fix here:

[FAQ] Issues with “signature is marginal trust”, "signature is unknown trust", or “invalid or corrupted package”

If you’re getting an error similar to “Can’t update: signature from *** is marginal trust” or “invalid or corrupted package” you probably just need to update your package signing keys: sudo pacman -Sy archlinux-keyring endeavouros-keyring sudo pacman -Syu Also make sure your system clock is correct! Of course, it’s also possible that the package file actually is corrupt. Remove it from /var/cache/pacman/pkg/ so pacman will download it again. If no package file is explicitly mentioned then yo…

---

@Isaac

but I’d want to know what’s gone wrong first, if possible.

@jonathon could probably give you more information on why, but basically it’s package signature mismatch (for whatever reason be it mistake of developer or just key expiration date is out), sometimes it’s keyserver problem…

Those problems are usually very rare, i had it maybe 1 time in 2 years

[Isaac]

@keybreak

You’ll find an answer how to fix here:

Worked a charm, thank you. I’d be interested if anyone does know why this happens. I’m pleased it’s such a simple fix, but was quite surprised when I put the error message into the internet and got no hits at all - I thought “why only me?”

[QAP]

@Isaac

Worked a charm, thank you. I’d be interested if anyone does know why this happens. I’m pleased it’s such a simple fix, but was quite surprised when I put the error message into the internet and got no hits at all - I thought “why only me?”

Happened once to me.

It happens when the day of package release and day you ran update the key he/she signed with expired during that time between.

Would make sense if Pacman just said it as such. Just say “Key expired etc”.

Sometimes even if have latest key it can go missing anyway and then just need to use sudo pacman-key --refresh to re-add what was already there.

[jonathon]

@Isaac

I’d be interested if anyone does know why this happens

The file is signed by a key that’s not in your current pacman keyring, so pacman doesn’t know about it. If you update archlinux-keyring then you get the new/updated/missing key and so pacman knows about it.

This normally only ever happens if you haven’t updated your system for a long time - keyrings are normally pushed out weeks before any new keys are used to sign packages.

General advice in that situation is to update archlinux-keyring before other packages (some derivatives patch pacman to include this as a SyncFirst option).