Manjaro Update fails: signature is unknown trust

Question

I was installing Manjaro GNOME 18.0.4 for my sister. However, when I tried to update all packages using pacman -Syu, the update fails due to two signature errors:

dunst package with signature by "Matti Hyttinen <[email protected]>"
notification-daemon with signature by "Brett Cornwall <[email protected]>"

Interestingly, there wasn't even anything I could have messed up, as this was the first thing I did after installation (and I reinstalled Manjaro, as it could have been a problem in installation). Additionally, it appears that both problematic packages are for notifications.

I - of course - already tried to look up the problem, and the solution I found over and over was

rm -r /etc/pacman.d/gnupg
pacman-key --init
pacman-key --populate archlinux manjaro
pacman-key --refresh-keys

as root. But this solution does not work at all in this case.

Full error message (Same with dunst):

$ sudo pacman -S notification-daemon
resolving dependencies...
looking for conflicting packages...

Packages (1) notification-daemon-3.20.0-3

Total Download Size:   0.05 MiB
Total Installed Size:  0.74 MiB

:: Proceed with installation? [Y/n] 
:: Retrieving packages...
 notification-daemon...    52.4 KiB  64.7K/s 00:01 [######################] 100%
(1/1) checking keys in keyring                     [######################] 100%
(1/1) checking package integrity                   [######################] 100%
error: notification-daemon: signature from "Brett Cornwall <[email protected]>" is unknown trust
:: File /var/cache/pacman/pkg/notification-daemon-3.20.0-3-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] 
error: failed to commit transaction (invalid or corrupted package (PGP signature))
Errors occurred, no packages were upgraded.

Edit: I changed all SigLevel options (4 in total) in /etc/pacman.conf to SigLevel = Never, ran pacman -Syu and changed SigLevel options back. The system is now up-to-date, but the problem is still there.

Does this [Manjaro forum post](https://forum.manjaro.org/t/update-invalid-or-corrupted-package/76556/3) help? — RubberStamp, May 11 '19 at 16:44
It does, apparently, and I don't know why I did not find this post myself. Thank you! — Alexander Schoch, May 11 '19 at 17:59
Please post the "solution" section as an answer and remove it from the question. — kelvin, Sep 16 '19 at 18:56

score 7 · Accepted Answer · answered Sep 24 '19 at 07:59

7

Solution:

open /etc/pacman.conf
change all SigLevel entries to Never (comment the old ones out)
pacman -Syu
change /etc/pacman.conf back
rm -r /etc/pacman.d/gnupg
pacman-key --init
pacman-key --populate archlinux manjaro
pacman-key --refresh-keys

answered Sep 24 '19 at 07:59

Alexander Schoch

383
5
15

score 4 · Answer 2 · answered Jan 07 '20 at 05:10

I had the same issue when the system was not updated for too long. Seems like some new keys were added since than and my "archlinux-keyring" package is way too old for this.

Here is what I had to do to fix it:

pacman-key --populate archlinux
pacman -S archlinux-keyring

Manjaro Update fails: signature is unknown trust

2 Answers2

Solution: