Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#30685 - gpg dev key are wrong for eclipse and libreoffice-common

Attached to Project: Arch Linux
Opened by Cedric Jeanneret (SwissTengu) - Sunday, 15 July 2012, 09:30 GMT
Last edited by Andreas Radke (AndyRTR) - Sunday, 15 July 2012, 11:47 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To No-one
Architecture i686
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

For two days now, the GPG signature seems to be wrong for (at least) two packages:

(60/60) checking package integrity
error: eclipse: signature from "Ionut Biru <ibiru@archlinux.org>" is invalid
error: libreoffice-common: signature from "Andreas Radke <andyrtr@archlinux.org>" is invalid
error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.

After a quick check, my archlinux-keyring is up-to-date:
warning: archlinux-keyring-20120622-1 is up to date -- reinstalling

Also, my keyring is good:
pacman-key --populate archlinux
[....]
Key not changed so no update needed.
==> Importing owner trust values...
==> Updating trust database...

For the two wrong signatures:
gpg: key 4C7EA887: "Ionut Biru (Arch Linux Master Key) <ionut@master-key.archlinux.org>" not changed
gpg: key 0F2A092B: "Andreas Radke <andyrtr@archlinux.org>" not changed

I'm using this mirror:
Server = http://archlinux.puzzle.ch/$repo/os/i686

Steps to reproduce:
pacman -Syu


Any help will be appreciated.
Thanks in advance!
This task depends upon

Closed by  Andreas Radke (AndyRTR)
Sunday, 15 July 2012, 11:47 GMT
Reason for closing:  None
Comment by Pierre Schmitz (Pierre) - Sunday, 15 July 2012, 09:46 GMT
The packages on the main mirror are fine.

Check if the local copies have these check sums:

2ef422293abb5c0f306fd1942bfa0728 extra/os/i686/libreoffice-common-3.5.5-1-i686.pkg.tar.xz
e18d32f631281a74684423f1e2eecb09 extra/os/i686/eclipse-4.2-1-i686.pkg.tar.xz

If not remove those and try to re-download. It's possible they got corrupted during transfer.
Comment by Cedric Jeanneret (SwissTengu) - Sunday, 15 July 2012, 10:03 GMT
Hello,

Good hint! seems that the eclipse package still crashes, I downloaded it 3 times, it doesn't match the md5sum :(
I'll try on another mirror for this one, maybe the archive is bad on puzzle?

Cheers,

C.
Comment by Cedric Jeanneret (SwissTengu) - Sunday, 15 July 2012, 10:17 GMT
Okay, the *eclipse* archive on puzzle is corrupted - tried with a simple wget, md5sum doesn't match.

I downloaded it from kernel.org, seems to work as expected.

Thanks for the support!

Cheers

C.
Comment by Pierre Schmitz (Pierre) - Sunday, 15 July 2012, 10:35 GMT
I just did the same and the package on puzzle.ch is fine.
Comment by Cedric Jeanneret (SwissTengu) - Sunday, 15 July 2012, 10:47 GMT
hmm. maybe I hit the (in)famous upc-cablecom problem with "large" file download? dunno...

anyway, this bug can be closed. it may be nice to check the md5sum before the gpg stuff, this way the error message will be more revelent.

Cheers,

C.

Loading...