Broken ArchLinux packages signatures #2801
Comments
|
I get the same error with QOwnNotes. Installed as described on http://www.qownnotes.org/installation "Install on Arch Linux" |
|
Any progress on this? |
|
I've also stumbled upon this issue. Interestingly enough, the incorrect signature doesn't happen in all my repositories, but when it does, it tends to be reproducible for the given repo. I've also encountered various other issues with packages for Arch, such as incorrect pkg size in metadata or broken checksum, which break the package installation even when signature checking is turned off in |
|
@tomaskrizek how do you reproduce the issue? Which repos are affected and which not? |
|
@ItachiSan heres one repo I know of that has this problem: https://download.opensuse.org/repositories/home:/justkidding:/arch/standard/x86_64/ |
|
@ItachiSan I'm facing this issue with |
Same for me as well.
|
|
The issue appears to be that OBS creates v3 signatures12 but pacman requires v43. I've confirmed this is the case for the OBS build of ungoogled_chromium. Curiously, GnuPG 2.1 (released 2014-10-03) dropped all support for v34. I'm not sure why Footnotes |
|
On Dienstag, 11. Januar 2022, 07:14:26 CET Nick Hanley wrote:
The issue appears to be that OBS creates v3 signatures[^1][^2] but pacman requires v4[^3]. I've confirmed this is the case for the OBS build of ungoogled_chromium.
```
$ wget https://download.opensuse.org/repositories/home:/ungoogled_chromium/Arch/x86_64/ungoogled-chromium-97.0.4692.71-2-x86_64.pkg.tar.zst{,.sig}
...
$ sudo pacman -U ungoogled-chromium-97.0.4692.71-2-x86_64.pkg.tar.zst
loading packages...
error: ungoogled-chromium-97.0.4692.71-2-x86_64.pkg.tar.zst: unsupported signature format
error: 'ungoogled-chromium-97.0.4692.71-2-x86_64.pkg.tar.zst': invalid or corrupted package (PGP signature)
$ gpg --list-packets ungoogled-chromium-97.0.4692.71-2-x86_64.pkg.tar.zst.sig | grep version
version 3, created 1641750733, md5len 5, sigclass 0x00
```
Curiously, GnuPG 2.1 (released 2014-10-03) dropped all support for v3[^4]. I'm not sure why `--force-v3-sigs` is being honored as it should be a no-op, unless OBS uses an ancient release.
it should still be able to verify it though.
However, #12065
…--
Adrian Schroeter ***@***.***>
Build Infrastructure Project Manager
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg) Geschäftsführer: Ivo Totev
|
I'm not sure what "it" you're referring to. Regardless, #12065 appears to work on my development instance. Thanks! FYI pacman has supported v4 signatures ever since GPG verification was added1; they became required in 20122. PGP 2 is ancient, after all. Footnotes |
|
Since #12065 has been merged, I tried this: This appears to be okay. |
Issue/Feature description
ArchLinux is a distro with the KISS principle and this works in all its components.
This works also on the packaging system; makepkg allows people to create packages really easily.
Packages can also be signed by setting the proper GPG key ID in the makepkg configuration file.
OBS offers ArchLinux packages support; however, signature for them is broken.
The signature produced by OBS gives errors when read from pacman, considered as 'unsigned'.
More details are available in my first e-mail sent to the OBS mailing list, see here.
makepkg expects a signature similar to the one generated by the command:
gpg --detach-sign --use-agent -u ${GPGKEY} --no-armor "$filename" &>/dev/nullso I suppose that OBS is using a different approach for package signatures.
After no reply in the mailing list (here), I decided to open an issue here.
I can provide as much data as possible, though I am not an official Arch developer working on
pacman nor makepkg.
Expected result
The signatures produced by OBS are properly loaded from pacman.
How to Reproduce
Given such a repo
I tried to install a package
The error lies within the
unsupported signature format.Further information
The text was updated successfully, but these errors were encountered: