Arch Linux

rev.cressy

Member

Registered: 2016-01-04

Posts: 5

Daily Backup Reveals change in /etc/pacman.d/gnupg/

I do a daily backup which checks for any changes in /etc and other directories that should not change unless you have done a backup.  On Christmas Day someone or something changed the following files:

/etc/pacman.d/gnupg/pubring.gpg
/etc/pacman.d/gnupg/pubring.gpg~
/etc/pacman.d/gnupg/pubring.gpg.tmp
/etc/pacman.d/gnupg/trustdb.gpg

I rebuilt my repositories with pacman -Syy
I reinstalled archlinux-keyring

I am familiar with the shenanigans  of cups changing their /etc files daily, but this is a first for me. 
I'm posting this as a warning of a possible break-in on Arch Linux systems.

Scimmia

Fellow

Registered: 2012-09-01

Posts: 11,560

Re: Daily Backup Reveals change in /etc/pacman.d/gnupg/

See archlinux-keyring-wkd-sync.{timer,service}

It will also be updated every time you reinstall archlinux-keyring, as you mentioned.

Using -Syy is a terrible idea for multiple reasons. Stick with -Syu.