Binary install from Arch repository fails because of invalid PGP signature

[syntaxman]

Describe the Bug

Followed steps for adding the repository and the key using pacman without error. When installing the pw3270 package, the repo and the package are successfully downloaded, but the install fails when comparing the PGP signature

System

• Arch on Intel - most recently updated today (2023/01/12)
• pw3270-5.4+git20221003-0-x86_64

error: pw3270: signature from "home:PerryWerneck OBS Project home:[email protected]" is invalid
:: File /var/cache/pacman/pkg/pw3270-5.4+git20221003-0-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).

[PerryWerneck]

Did you install the key file?

The instructions about adding the repository and key file can be found in https://software.opensuse.org/download.html?project=home%3APerryWerneck%3Apw3270&package=pw3270

[syntaxman]

Yes, I followed all of those instructions directly. I did get it installed and working by using the direct binary download method. I did notice however, that there was no documentation or otherwise that connected the two libraries that needed to be downloaded as well (seemed to be mentioned for the Windows install if I recall correctly). I figured it out, though. Wade

…

On Sun, Jan 15, 2023 at 5:41 AM Perry Werneck ***@***.***> wrote: Did you install the key file? The instructions about adding the repository and key file can be found in https://software.opensuse.org/download.html?project=home%3APerryWerneck%3Apw3270&package=pw3270 — Reply to this email directly, view it on GitHub <#43 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVPD7J5DPEAMZ3HKURIZQ3WSP5CHANCNFSM6AAAAAAT2BF4X4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[PerryWerneck]

I dont use arch then, I dont know if there are any diferente between download the binary directly or using the repositories, but, the message error looks related with missing key file.

[syntaxman]

I've seen similar messages when the repo is updated, but the hash isn't. I believe that installing just from the file doesn't check for a key at all.

…

On Sun, Jan 15, 2023 at 3:30 PM Perry Werneck ***@***.***> wrote: I dont use arch then, I dont know if there are any diferente between download the binary directly or using the repositories, but, the message error looks related with missing key file. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[PerryWerneck]

Well it's doing some kind of check since it's showing the message about invalid signature, this message usually happend when it cant find the key to validate the signature.

[syntaxman]

The invalid signature message happens when I'm using the repository. When I download the .zst file and use "pacman -U <filename.zst>", then it installs without any error messages.

…

On Sun, Jan 15, 2023 at 6:42 PM Perry Werneck ***@***.***> wrote: Well it's doing some kind of check since it's showing the message about invalid signature, this message usually happend when it cant find the key to validate the signature. — Reply to this email directly, view it on GitHub <#43 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABVPD7MUY37KHZTNIMNHFV3WSSYR3ANCNFSM6AAAAAAT2BF4X4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[benjamimgois]

@syntaxman i came here to report the same issue, but your solution to manually install the .zst solved my problem. Thanks !