# I'm getting an 'invalid or corrupted package (PGP signature)' error which is preventing updates **URL:** \ **Category:** General system\ **Created:** [September 19, 2021, 7:35am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799 "2021-09-19T07:35:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Isaac](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/i/8e8cbc/32.png) [@Isaac](https://forum.endeavouros.com/u/Isaac)\ **Post date:** [September 19, 2021, 7:35am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/1 "2021-09-19T07:35:10Z")
My updates are getting stuck on polkit-0.119-1-x86\_64. The error message is ```auto error: polkit: signature from "Jonas Witschel " is unknown trust File /var/cache/pacman/pkg/polkit-0.119-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] ``` I chose the default Y, then get ```auto error: failed to commit transaction (invalid or corrupted package) Errors occurred, no packages were upgraded. ``` I can’t find any reports of this error. I did find a suggestion in a related error to replace the keyrings, but I’d want to know what’s gone wrong first, if possible. `pacman -Q archlinux-keyring` gives `archlinux-keyring 20210110-1`, in case that helps. Thanks ---
**Author:** ![keybreak](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/keybreak/32/9257_2.png) [@keybreak](https://forum.endeavouros.com/u/keybreak)\ **Post date:** [September 19, 2021, 7:38am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/2 "2021-09-19T07:38:43Z")
Welcome! 🥳 You’ll find an answer how to fix here: > [@\[FAQ\] Issues with “signature is marginal trust”, "signature is unknown trust", or “invalid or corrupted package”](https://forum.endeavouros.com/t/faq-issues-with-signature-is-marginal-trust-or-invalid-or-corrupted-package/6756): > > If you’re getting an error similar to “Can’t update: signature from \*\*\* is marginal trust” or “invalid or corrupted package” you probably just need to update your package signing keys: sudo pacman -Sy archlinux-keyring endeavouros-keyring sudo pacman -Syu Also make sure your system clock is correct! Of course, it’s also possible that the package file actually is corrupt. Remove it from /var/cache/pacman/pkg/ so pacman will download it again. If no package file is explicitly mentioned then yo… * * * > [@Isaac](#): > > but I’d want to know what’s gone wrong first, if possible. @jonathon could probably give you more information on why, but basically it’s package signature mismatch (for whatever reason be it mistake of developer or just key expiration date is out), sometimes it’s keyserver problem… Those problems are usually very rare, i had it maybe 1 time in 2 years 🙂 ---
**Author:** ![Isaac](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/i/8e8cbc/32.png) [@Isaac](https://forum.endeavouros.com/u/Isaac)\ **Post date:** [September 19, 2021, 8:08am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/3 "2021-09-19T08:08:12Z")
> [@keybreak](#): > > You’ll find an answer how to fix here: Worked a charm, thank you. I’d be interested if anyone does know why this happens. I’m pleased it’s such a simple fix, but was quite surprised when I put the error message into the internet and got no hits at all - I thought “why only me?” ---
**Author:** ![QAP](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/qap/32/33263_2.png) [@QAP](https://forum.endeavouros.com/u/QAP)\ **Post date:** [September 19, 2021, 11:02am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/4 "2021-09-19T11:02:34Z")
> [@Isaac](#): > > Worked a charm, thank you. I’d be interested if anyone does know why this happens. I’m pleased it’s such a simple fix, but was quite surprised when I put the error message into the internet and got no hits at all - I thought “why only me?” Happened once to me. It happens when the day of package release and day you ran update the key he/she signed with expired during that time between. Would make sense if Pacman just said it as such. Just say “Key expired etc”. Sometimes even if have latest key it can go missing anyway and then just need to use sudo pacman-key --refresh to re-add what was already there. ---
**Author:** ![jonathon](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jonathon/32/18722_2.png) [@jonathon](https://forum.endeavouros.com/u/jonathon)\ **Post date:** [September 19, 2021, 11:17am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/5 "2021-09-19T11:17:44Z")
> [@Isaac](#): > > I’d be interested if anyone does know why this happens The file is signed by a key that’s not in your current pacman keyring, so pacman doesn’t know about it. If you update `archlinux-keyring` then you get the new/updated/missing key and so pacman knows about it. This normally only ever happens if you haven’t updated your system for a long time - keyrings are normally pushed out weeks before any new keys are used to sign packages. General advice in that situation is to update `archlinux-keyring` before other packages (some derivatives patch pacman to include this as a `SyncFirst` option). ---
**Author:** ![system](https://forum.endeavouros.com/uploads/default/original/2X/9/9ea52f9fd5ef8e609e593c362d61a36295f48be8.png) [@system](https://forum.endeavouros.com/u/system)\ **Post date:** [September 21, 2021, 11:18am UTC](https://forum.endeavouros.com/t/im-getting-an-invalid-or-corrupted-package-pgp-signature-error-which-is-preventing-updates/17799/6 "2021-09-21T11:18:08Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.