Summary and Info:

I'm running a recent arch install with the default pacman.conf file (plus multilib uncommented). The documentation leads me to believe that when a repository contains:

SigLevel = Required DatabaseOptional

(which is the default for all repos), then packages must be signed, even if the database (which I presume means the .db file) is not signed.

However, this is not the behavior I'm seeing, in which signatures are not required at all. I'm marking this bug high severity because at the very least the documentation can lead people to do dangerous things. For example, I have updated my laptop over insecure wireless networks, believing that that each package would be signed so that even a corrupt db file would only lead me to miss updates for certain packages.

Steps to Reproduce:

Set up an ftp or http server mirroring some arch packages. An easy way to do this is to combine the contents of /var/cache/pacman and /var/lib/pacman/sync somewhere on your ftp server. I do this as a convenient way of installing a whole cluster without downloading packages multiple times. However, since arch doesn't cache the .sig files (which I wish it would), there will be no signatures.

Then set up an arch client whose /etc/pacman.d/mirror list contains your server (which has no signatures) and none of the standard servers. Now try installing packages. You will see pacman happily install the completely unsigned packages.