Archlinux template gpg key errors

I installed the archlinux template from the template manager and it installed without an issue. There was a notification for an update available and when I go to install the update it failed. I loaded the template and attempted to update manually and came across multiple package replacement prompts and multiple gpg key failures leading to corrupt packages.

I believe there was another replacement but am unable to replicate it. These are two that I come across:

Replace dbus-python with extra/python-bus? [Y/n]
Replace tracker3 with extra/tinysparql? [Y/n]

After choosing yes for both the packages load prompting to confirm update. After choosing yes, the packages DL and then get checked for integrity which then leads to these errors:

gtk-layer-shell: signature from "..." is uknown trust
File ..../pacman/pkg/gtk-layer-shell...tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Dow you want to delete it? [Y/n]

The same error for different signatures occur for:
python-cairo
python-jaraco.functools
python-cairo-text

I am unsure of the necessity of the packages so I choose not to delete them and the update fails.

Any solutions for this? I am hesitant to find pgp signatures and load them onto the template and want to be confirmed by the community before attempting to.

this is probably the wrong answer

when i update templates using whonix there are times when i get that there is error because of files don’t match what is expected

i don’t know why this happens. malicious tor exit node? just part of the file packet that had error? i don’t investigate and just try again and eventually there’s update go through

this could be bad approach, see what other says

Hi @ipseonet ,

welcome to the QubesOS world :+1: .

From my point of view, this is not a qubesOS issue. It’s the process of update of a long-not-updated ArchLinux installation.

I suggest you read the pacman-key ArchLinux documentation.

In such issue, in general I update only the keyring packages (something like pacman -S archlinux-keyring qubes-vm-keyring) and sometimes I need to also update the local keyring (see pacman-key --init and/or pacman-key --refresh-keys in the above ArchLinux doc). Then I update all the ArchLinux OS.

The above Replace prompts are not a part of the problem (and are not a problem).

1 Like

I think the real problem behind arch linux gpg keys for packages maintainers is that gpg does not use the proxy and thus can’t reach the keyserver. :confused:

I tried to make gpg use the proxy, without success so far.

1 Like

Also if I you are not already on the current-testing repository, I suggest you switch to it:

cat /etc/pacman.d/85-qubes-4.2-current-testing.conf
[qubes-r4.2-current-testing]
Server = https://archlinux.qubes-os.org/r4.2/current-testing/vm/archlinux/pkgs

In Qubes-OS, cloning a qube (AppVM) or a template is very easy, so you can clone your template and do the update tests in the clone…