Arch Linux

Description:

When building multiple packages at the same time, they may download the same package at the same time. One of them gets the error like:

error: wcslib: signature from "Antonio Rojas <arojas@archlinux.org>" is invalid
:: File /var/cache/pacman/pkg/wcslib-7.10-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]
error: failed to commit transaction (invalid or corrupted package (PGP signature))
Errors occurred, no packages were upgraded.

The other gets:

wcslib-7.10-1-x86_64.pkg.tar.zst failed to downloaderror: could not rename /var/cache/pacman/pkg/wcslib-7.10-1-x86_64.pkg.tar.zst.part to /var/cache/pacman/pkg/wcslib-7.10-1-x86_64.pkg.tar.zst (No such file or directory)
warning: failed to retrieve some files
error: failed to commit transaction (unexpected error)
Errors occurred, no packages were upgraded.

This happens because the latter curl finds that a partially downloaded file exists, and uses O_APPEND to write to the file.

I suggest pacman to hold a flock during download in the cache directory and wait until it unlocks.