[SOLVED] Key ID Errors on AArch64 Updates

by **jclds139** » Fri Apr 07, 2023 3:01 pm

I keep running into errors on my aarch64 boxes where pacman prompts this on updates:
$this->bbcode_second_pass_code('', ':: Import PGP key 77193F152BDBE6A6, "Arch Linux ARM Build System <builder+seattle@archlinuxarm.org>"? [Y/n]')

The `+seattle` part changes. I've gotten `seattle` and `n1` so far, I'm sure there are others, probably corresponding to the build servers.

If I say no, then it cancels the transaction. If I say yes, then it fails because the e-mail address isn't listed on any keyservers.
I've rebuilt my keyring multiple times and that key fingerprint is already in the keyring, but the e-mail is invalid.

Is this something that can be fixed with pacman configuration? Or is it a configuration problem with the builders? Either way, can we either upload all of the variants on `builder+<place>@archlinuxarm.org` or fix the build infrastructure so it always generates signatures as `builder@archlinuxarm.org` to match the keyid in the keyring?

by **jclds139** » Fri Apr 07, 2023 6:58 pm

I found a workaround for now, at least.
If you add the following to pacman's gpg.conf then it'll use the valid key even though the email is wrong:
$this->bbcode_second_pass_code('', '
trust-model tofu+pgp
tofu-default-policy unknown
')

This keeps it from actually trusting additional keys, but uses the trust-on-first-use conflict detection which handles the messed up emails.

EDIT: never mind, it only seemed to have worked once. Is there some better way to seek help on this?

by **jclds139** » Wed Apr 12, 2023 3:49 am

Another smidge of progress: the current version of gpgme is apparently related. After downgrading to gpgme-1.18 I can do updates properly again.

For now I'll just IgnorePkg it until the next version comes in, but we should figure out what happened upstream eventually.

by **jclds139** » Sat Apr 22, 2023 2:44 am

The update to gpgme 1.20 fixed this today, so this is now resolved.

by **jclds139** » Fri Jul 14, 2023 2:32 am

This should be the last time, but this should be out there for any future people hitting similar issues.

The error came down to gpg crashing because it was passed an empty --display argument by gpgme. Generally this isn't an issue, since $DISPLAY is just unset if it would be empty, but I had some shell script-fu to work around X11 forwarding in tmux that was setting it even if it was empty, causing this whole chain of problems when gpgme updated to 1.19.0 or later.