error: XXXX : signature from "David macek <david.macek.0@gmail.com>" is invalid

[hamlibdk]

Describe the issue

running pacman -Syuu ... Receiving messages:

$ pacman -Syuu
error: mingw32: signature from "David Macek <david.macek.0@gmail.com>" is invalid
error: msys: signature from "David Macek <david.macek.0@gmail.com>" is invalid
:: Synchronizing package databases...
 mingw32                         891.1 KiB   754 KiB/s 00:01 [###############################] 100%
 mingw32.sig                     438.0   B  0.00   B/s 00:00 [###############################] 100%
error: mingw32: signature from "David Macek <david.macek.0@gmail.com>" is invalid
error: failed to update mingw32 (invalid or corrupted database (PGP signature))
 mingw64 is up to date
 msys                            300.4 KiB   641 KiB/s 00:00 [###############################] 100%
 msys.sig                        438.0   B  0.00   B/s 00:00 [###############################] 100%
error: msys: signature from "David Macek <david.macek.0@gmail.com>" is invalid
error: failed to update msys (invalid or corrupted database (PGP signature))
error: failed to synchronize all databases

Steps to Reproduce the Problem

pacman -Syuu

have tried steps at https://www.msys2.org/news/ --> 2020-06-29 - new packagers ... They do not resolve issues

Additional Context: Operating System, Screenshots

• OS: [e.g. Windows 10 Pro version 20H2 64bit]

[Biswa96]

Have you tried to install with latest installer from here https://github.com/msys2/msys2-installer/releases?

[hamlibdk]

That is not a solution or a mitigation ... especially since the "last resort fix-all" steps at https://www.msys2.org/news/ fail !

Yet for the record a redeploy from scratch FAILS with the same error.

It was basically working well prior to 2021-2-16 00:00z ... Problems after that time !

The matter is of critical urgency as this is part of as Software Developers' kit - that integrates with Qt - used by many-many of non-commercial developers.

[mayd]

I am experiencing exactly the the same error.

I upgrade my MSYS2 installation weekly, on average, and it was working up until two days ago.
Today the pacman upgrade procedure is no longer working.

[lazka]

Likely sourceforge having problems. Waiting a bit might help.

[hamlibdk]

** * A WORK AROUND * **

I have a work-around - that being to Disable Signature Checking (ref: ) that appears to make the environment function again.. However, I would recommend the following procedure FIRST (ref: https://www.msys2.org/news/ )

Stage 1: From https://www.msys2.org/news/

If you still see signature errors, resetting your pacman key store might help:

# rm -r /etc/pacman.d/gnupg/
# pacman-key --init
# pacman-key --populate msys2

Stage 2: https://wiki.archlinux.org/index.php/Pacman/Package_signing

Disabling signature checking

Warning: Use with caution. Disabling package signing will allow pacman to install untrusted packages automatically.
If you are not concerned about package signing, you can disable PGP signature checking completely. Edit /etc/pacman.conf and uncomment the following line under [options]:

SigLevel = Never

You need to comment out any repository-specific SigLevel settings too because they override the global settings. This will result in no signature checking, which was the behavior before pacman 4. If you decide to do this, you do not need to set up a keyring with pacman-key. You can change this option later if you decide to enable package verification.

[geedeee]

Having the same issue here as well.
I update weekly. Last week was working fine.

[mayd]

I already considered bypassing pacman digital signature checking.

However, until I am sure that the cause of this problem is not some kind hack I am reluctant to proceed. After all, it would be an effective way to infect lots of computers. Could be another SolarWinds!

I am amazed that nobody from the MSYS2 project team has yet commented on this issue and provided reassurance to users.

[jeremyd2019]

I have several msys2 installs around on a couple of different machines, and I am not seeing this on any of them. However, @elieux did recently update his key, and there was apparently an issue with the msys2-keyring package update not including cross signatures for it (msys2/MSYS2-keyring#6). I don't know if it was related, but the timing is suspicious.

[lazka]

then pacman-key --refresh might help

[rogerd007]

then pacman-key --refresh might help

Unfortunately not for me - it said the key for David macek was unchanged.

If you still see signature errors, resetting your pacman key store might help:

Unfortunately this did not solve the problem either.

[mingwandroid]

I tried pacman-key --refresh and although it said the same thing, subsequent updates worked (the next update reported the same error but proceeded anyway and the update after that didn't have the error at all).

Can you see if the same is true in your situation?

[rogerd007]

Can you see if the same is true in your situation?

No, no matter how many times I run pacman -Syuu after doing the refresh, I still get the same error messages as the initial post.

[lazka]

what about -Syyuu ?

[rogerd007]

what about -Syyuu ?

Unfortunately, still the same outcome.

$ pacman -Syyuu error: mingw32: signature from "David Macek <david.macek.0@gmail.com>" is invalid error: msys: signature from "David Macek <david.macek.0@gmail.com>" is invalid :: Synchronizing package databases... mingw32 891.1 KiB 2.75 MiB/s 00:00 [#####################] 100% mingw32.sig 438.0 B 0.00 B/s 00:00 [#####################] 100% error: mingw32: signature from "David Macek <david.macek.0@gmail.com>" is invalid error: failed to update mingw32 (invalid or corrupted database (PGP signature)) mingw64 894.5 KiB 4.01 MiB/s 00:00 [#####################] 100% mingw64.sig 438.0 B 0.00 B/s 00:00 [#####################] 100% msys 300.4 KiB 3.86 MiB/s 00:00 [#####################] 100% msys.sig 438.0 B 0.00 B/s 00:00 [#####################] 100% error: msys: signature from "David Macek <david.macek.0@gmail.com>" is invalid error: failed to update msys (invalid or corrupted database (PGP signature)) error: failed to synchronize all databases

[rogerd007]

I think it's an issue with the sourceforge mirror, as I disabled the sourceforge mirror in pacman.conf, and when I ran pacman -Syuu it complained of the keys being of "marginal trust", as opposed to "invalid". After running pacman-key --refresh I was able to successfully run pacman -Syuu and it updated asciidoc and msys2-keyring-1~20210213-1.

Upon completion I re-enabled the sourceforge mirrors and pacman -Syyuu reverts to the "invalid" error regarding the David Macek signature.