Errors: Public keyring not found & signatur ... unknown trust ...

kde-user

Hello,

I have 5 CachyOS systems here, my main system and 4 virtual machines (VirtualBox).

I keep having problems like this, especially on the virtual machines:

cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust

On my main system I only had the problem once at the very beginning when installing, and not again after that. I don’t remember exactly how I managed to remedy the situation (but most likely with one of the commands mentioned below).

Things initially ran fine on my VMs, but then the error gradually appeared in one or another VM.
Mainly I’m trying to update in the VMs with Pamac (GUI), mainly just to see how it works! And then things quickly stop working with Pamac.

Currently (and using this as an example) I have the problem again quite stubbornly in a VM (while, strangely enough, another VM was also able to be updated without any problems today).

This time I wanted to start the update directly via yay.

Unfortunately, my system was set to German at the time of the update and therefore the output in the terminal is also partly in German.

Well, what to do now? Leave it in German (so as not to distort it) and hope that it will still be understood (ptr1337 can at least speak German)?
I decided to run at least the shorter versions through Google Translate (which is why one or two expressions may not fit correctly!):

❯ yay -Syu [sudo] password for xxx: Warning: Public keyring not found; have you run 'pacman-key --init'? Error: cachyos: Key "882DCFE48E2051D48E2562ABF3B607488DB35A47" is unknown Error: Keychain cannot be written :: Package databases are synchronized... cachyos 392.9 KiB 1584 KiB/s 00:00 [------------------------------------------------ -------] 100% core is current extra is current multilib 141.7 KiB 644 KiB/s 00:00 [------------------------------------------------ -------] 100% Error: cachyos: Key "882DCFE48E2051D48E2562ABF3B607488DB35A47" is unknown Error: Keychain cannot be written Error: No database could be synchronized (Unexpected error) -> Error updating databases - exit status 1

Since yay kindly suggested ‘pacman-key –init’ to me, I thought I’d try it out:

❯ sudo pacman-key --init ==> Generate Pacman master key. May take a while. gpg: Generating pacman keyring master key... gpg: Revocation certificate saved as '/etc/pacman.d/gnupg/openpgp-revocs.d/6ECE5B1094C95BC5E2D5E5F7DB85C2C4F0487966.rev'. gpg: Done ==> Update trust database... gpg: public key of ultimate trusted key CC93EE25930036C2 not found gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 2 signed: 0 confidence: 0-, 0q, 0n, 0m, 0f, 2u ==> ERROR: Unable to update trust database.

Then I tried out a few commands that I had put together here in a similar context:

❯ sudo pacman -Sy archlinux-keyring Error: cachyos: Key "882DCFE48E2051D48E2562ABF3B607488DB35A47" is unknown ::Import PGP key 882DCFE48E2051D48E2562ABF3B607488DB35A47? [Y/n] j Error: cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust :: Package databases are synchronized... cachyos 392.9 KiB 1723 KiB/s 00:00 [------------------------------------------------ -------] 100% core 130.2 KiB 486 KiB/s 00:00 [------------------------------------------------ -------] 100% extra is current multilib is up to date Error: cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust Error: No database could be synchronized (Unexpected error)

I no longer have the terminal output from the next command, so I’ll write it shortened like this:
sudo pacman-key --refresh-keys
-> cachyos: signature from “CachyOS admin@cachyos.org” is unknown trust

And I tried one more command:

sudo pacman-key --lsign-key cachyos -> Sign key 1 locally... ==> Update trust database... gpg: public key of ultimate trusted key CC93EE25930036C2 not found gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 2 signed: 1 confidence: 0-, 0q, 0n, 0m, 0f, 2u gpg: depth: 1 valid: 1 signed: 0 confidence: 1-, 0q, 0n, 0m, 0f, 0u ==> ERROR: Unable to update trust database.

Every now and then I restarted (in case the commands need a restart to work).

Then I just tried an update (sudo pacman -Syu) again:

Here is a shortened translation into English (from where the update got strange!):
(The entire terminal output has no space here either, as the post is limited to I think 65,000 characters.)

... ... ... Required keys are downloaded... :: Import PGP key 76A5EF9054449A5C, "Pierre Schmitz <pierre@archlinux.org>"? [Y/n] y :: Import PGP key 06096A6AD1CEDDAC, "Laurent Carlier <lordheavym@archlinux.org>"? [Y/n] y :: Import PGP key 771DF6627EDF681F, "Tobias Powalowski <tpowa@archlinux.org>"? [Y/n]yj :: Import PGP key 6D42BDD116E0068F, "Christian Hesse <eworm@archlinux.org>"? [Y/n] y :: Import PGP key B02854ED753E0F1F, "Anatol Pomozov <anatolik@archlinux.org>"? [Y/n] y :: Import PGP key 9D4C5AA15426DA0A, "Frederik Schwan <freswa@archlinux.org>"? [Y/n] y :: Import PGP key E0959FEA8B550539, "George Rawlinson <grawlinson@archlinux.org>"? [Y/n]y :: Import PGP key C32217F6F13FF192, "Alexander F. Rødseth <xyproto@archlinux.org>"? [Y/n]y :: PGP key F296BDE50368C6CE, »T.J. Townsend <blakkheim@archlinux.org>« import? [Y/n] y (11/88) Packet integrity is checked [c o o o o o o o o o o o o o o ] 2(88/88) Packet integrity is checked [------------- --------------------] 100% Error: zlib: signature from "Levente Polyak <anthraxx@archlinux.org>" is unknown trust :: File /var/cache/pacman/pkg/zlib-1:1.3-2-x86_64.pkg.tar.zst is corrupted (Invalid or corrupted package (PGP signature)). Should the file be removed? [Y/n] y ... ... ... Error: The operation could not be performed (Invalid or corrupted package (PGP signature)) Errors occurred, no packages were updated.

You have to confirm all 88 packages (I think it said 88 somewhere) individually with yes or no. In the above case I confirmed everything with Yes. But even if I confirm everything with no, it doesn’t work.

When I try to update again, I currently don’t get the error message again: cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust.
But the last mentioned error, where I have to confirm each package individually with yes or no.

Now I don’t know what to do anymore! 🙁

MBK

kde-user

Look at the solution here:

https://www.reddit.com/r/cachyos/comments/15n43lv/announcement_refresh_the_gpg_key/

kde-user

Thanks for the info.

I tried the two commands:

`❯ sudo pacman-key –recv-keys F3B607488DB35A47 –keyserver keyserver.ubuntu.com
[sudo] password for john:
gpg: key F3B607488DB35A47: “CachyOS admin@cachyos.org” not changed
gpg: Total number processed: 1
gpg: unchanged: 1

~
❯ sudo pacman-key –lsign-key F3B607488DB35A47
-> Locally signed 1 keys.
==> Updating trust database…
gpg: no need for a trustdb check`

Then I restarted system to be on the safe side.
Tried to update (sudo pacman -Syu) -> same errors, example:

... error: iana-etc: signature from "Jelle van der Waa <jelle@archlinux.org>" is unknown trust :: File /var/cache/pacman/pkg/iana-etc-20231018-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] ...

This is then repeated for each individual package.

Then I tried the third command mentioned there with the following result:

❯ sudo pacman-key --refresh-keyssudo pacman -Sy [sudo] password for john: pacman-key: invalid option '--refresh-keyssudo'

Now I’ll try the tip from the last comment there (reset all the keys) …

kde-user

❯ sudo rm -rf /etc/pacman.d/gnupg
[sudo] password for xxx: 

~
❯ sudo pacman-key --init
gpg: /etc/pacman.d/gnupg/trustdb.gpg: trustdb created
gpg: no ultimately trusted keys found
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/etc/pacman.d/gnupg/secring.gpg' to gpg-agent
gpg: migration succeeded
==> Generating pacman master key. This may take some time.
gpg: Generating pacman keyring master key...
gpg: directory '/etc/pacman.d/gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/etc/pacman.d/gnupg/openpgp-revocs.d/104A938BBB9AE38D62F84213B81C9FEE4CBCC92E.rev'
gpg: Done
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u

~
❯ sudo pacman-key --populate
==> Appending keys from archlinux.gpg...
==> Appending keys from cachyos.gpg...
==> Locally signing trusted keys in keyring...
  -> Locally signed 6 keys.
==> Importing owner trust values...
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: setting ownertrust to 4
gpg: inserting ownertrust of 4
gpg: setting ownertrust to 4
==> Disabling revoked keys in keyring...
  -> Disabled 41 keys.
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   6  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   6  signed:  94  trust: 0-, 0q, 0n, 6m, 0f, 0u
gpg: depth: 2  valid:  71  signed:  27  trust: 71-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2023-10-31

~ 15s
❯ sudo pacman-key --recv-keys F3B607488DB35A47 --keyserver keyserver.ubuntu.com
gpg: key F3B607488DB35A47: "CachyOS <admin@cachyos.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

~
❯ sudo pacman-key --lsign-key F3B607488DB35A47
  -> Locally signed 1 keys.
==> Updating trust database...
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   7  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   7  signed:  94  trust: 1-, 0q, 0n, 6m, 0f, 0u
gpg: depth: 2  valid:  71  signed:  27  trust: 71-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2023-10-31

Then restarted, tried the update -> now it finally worked!!
Phew, I don’t know how/if you say it like that in English (it might sound strange!): That was a pretty difficult birth!

The problem is also: The error cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust
keeps coming up in my four VMs.
So far I have always gotten rid of it with one of the commands mentioned in the first post. Then the update went through and usually the next update, but then, after the second or third update at the latest, the same error message again…

Strangely (and fortunately!) I haven’t had the message on my main system yet.

But why could it be that the message keeps coming on four systems over and over again?

kde-user

Here is a typical update history, using one of my VMs as an example (I started logging on October 1st, 2023):

01.10.23 (Day.Month.Year): Pamac: Error synchronizing databases, invalid or corrupted database
Pacman: error: cachyos: signature from "CachyOS <admin@cachyos.org>" is unknown trust
Sudo pacman-key --refresh-keys was executed, then the update (via Pamac) worked again.
09.10.23: Pamac: Error synchronizing databases …
Sudo pacman-key --refresh-keys ran (didn’t fix the error) +
sudo pacman-key --lsign-key cachyos (did not fix the error), via Yay Update possible and executed (despite the signature warning!)!
15.10.23: First checked via Yay: Yay update would be possible without an error message
Pamac update possible again and carried out
19.10.23: Pamac update worked
21.10.23: Pamac, error synchronizing databases … updated via Yay (there was also an error message, but update was still possible)
28.10.23: First looked via Yay: Yay update would be possible without an error message
Pamac update possible and carried out

As you can see, it’s like flipping a coin whether the error message comes up (and therefore the update via Pamac doesn’t work) or it works. In October it worked 3 times and not 3 times.
Especially if you want to update via Pamac (which I think would be particularly helpful for many beginners/not so experienced users), this error message will stop you immediately and an update via Pamac will not work.
As far as I remember or wrote it down, the update runs via yay or Pacman, but then goes through despite the error message. I no longer know whether it could happen that an update via Yay or Pacman is not possible when this error message appears and I can no longer reconstruct it based on my notes.

I also suspected that the error message was somehow triggered by Pamac, although I don’t think that could be the case?! That’s why I sometimes started using Yay to see whether the error message came up or not before I started the update with Pamac.
Because strangely enough, I never had the message in my main system, where I’ve always been nice and good with Pacman update!

MBK

kde-user

During the past years, on all of the arch forums, they always say that pamac shouldn’t be used on arch systems and that it creates problems (it works and then suddenly there are problems).

I use this:

yay for updates + installing packages that don’t need searching (as it’s so fast to just type 3 letters)
arch & aur websites to search for packages
octopi for searching, installing, updating to arch repo packages. Especially when there are conflicts in the cachyos repos (it’s easy to sort the outdated packages in red ( select them to get the arch repo packages)
Discover in the rare cases when I don’t know an app, for the screenshots, descriptions, etc…

=> take a good look at Octopi. It’s really good. And fast.

kde-user

Yes, I am aware of the problem with Pamac. That’s why I don’t use Pamac for updates on my main system. I currently only update there via Pacman, as luckily I don’t need any packages from the AUR at the moment.

But I still wanted to test (in the VMs) how Pamac runs with CachyOS.
Because, this should also be noted: I had been using it with Manjaro for about 2 years now and it mostly worked quite well there!
And together with the 4 CachyOS VMs, I also run two VMs with EndeavourOS and several with Manjaro and so far the updates with Pamac have been running flawlessly in the same period of time (a few months).
Although - speaking of the devil - I just wanted to update a Manjaro VM with Pamac and it also had “signature … unknown trust”!
The problem there was also very persistent and could ultimately only be solved with the latter commands from your page linked above:

# reset all the keys:
# https://wiki.archlinux.org/title/Pacman/Package_signing#Resetting_all_the_keys
sudo rm -rf /etc/pacman.d/gnupg
sudo pacman key --init
sudo pacman-key --populate

Strange, what’s going on with this “signature … unknown trust” or the keys (e.g. public keyring not found)?

Can something like this be caused by Pamac? I don’t think so, right?

I think Pamac is great, if you’re looking for a program quickly and/or want to know, for example, in what form it is available, Repo, AUR or Flatpak.
Or even if you are no longer sure in which form you have already installed a program (sometimes this happens to me!). Then you click on “Installed” in Pamac, enter the program name and you can see whether it is from the repo, Flatpak or AUR.
I think you can easily use Pamac for that, without damaging anything.

Or what I always liked to use Pamac under Manjaro for, was to remove orphaned packages and their dependencies. And even Pamac critics admit that Pamac has apparently found a fairly elegant way to (usually!) remove not too many and not too few packages.

Octopi certainly has its advantages (to go through all of this in detail here would probably go beyond the scope, and what you write with the “outdated packages” sounds rather advanced to me, I haven’t done/have to do anything like that yet) , otherwise it doesn’t really offer any added value for me. I’d rather just take the console.

According to what I’ve read in forums, Discover is supposed to be even worse than Pamac. I’ve installed it in a few VMs (or, for example, with MXLinux it’s the pre-installed updater), but I don’t think the program is particularly good. Okay, it shows you a nice diagram of the programs. But beyond that, it always annoyed me with update notifications (or automatically checked for updates when the program started) and I couldn’t find a way to turn it off.

MBK

kde-user Can something like this be caused by Pamac?

All I can say is that I didn’t use pamac and didn’t have this problem.

kde-user what you write with the “outdated packages” sounds rather advanced to me

octopi menu Display > Outdated packages. When pacman doesn’t show you any updates, this will still show you all the updates in the arch repos in red (and they are 100% compatible. If you install them, they will also get updated again when the updates reach the cachyos repos as the cachyos repos priority is higher in pacman.conf).

kde-user Discover … and I couldn’t find a way to turn it off.

To turn the notification off: kde systemsettings > system > updates.