Arch Linux

brianrobt

Member

From: St. Louis, MO

Registered: 2024-05-18

Posts: 2

[SOLVED] Unable to Install nodejs: Corrupted Package (unknown GPG key)

Hi everyone,

I'm trying to install nodejs in a fresh Docker container, but am running into an error that one of its dependencies, simdjson was signed by an corrupted untrusted GPG key, which aborts the install:

[builder@65b2f81453b4 ~]$ yay -S nodejs
Sync Explicit (1): nodejs-24.3.0-1
resolving dependencies...
looking for conflicting packages...

Package (4)      New Version  Net Change  Download Size

extra/c-ares     1.34.5-1       0.51 MiB       0.22 MiB
extra/libngtcp2  1.13.0-1       0.61 MiB       0.18 MiB
extra/simdjson   1:3.13.0-1     5.23 MiB       0.23 MiB
extra/nodejs     24.3.0-1      68.77 MiB      16.82 MiB

Total Download Size:   17.44 MiB
Total Installed Size:  75.12 MiB

:: Proceed with installation? [Y/n] 
:: Retrieving packages...
 nodejs-24.3.0-1-x86_64 downloading...
 simdjson-1:3.13.0-1-x86_64 downloading...
 c-ares-1.34.5-1-x86_64 downloading...
 libngtcp2-1.13.0-1-x86_64 downloading...
checking keyring...
checking package integrity...
error: simdjson: signature from "Bert Peters (packager key) <bertptrs@archlinux.org>" is unknown trust
:: File /var/cache/pacman/pkg/simdjson-1:3.13.0-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.
 -> error installing repo packages

I'm going to try to import the key manually in the next few minutes to see if that fixes it, but I would expect the package manager to automatically import the key.  Maybe that's not the issue and the signing key is expired, or I'm doing something else wrong.  I'm surprised that no one else has reported this issue yet, though, so it's probably something that I'm not doing right on my end.

Solution

Credit to gromit and Scimmia

The archlinux-keyring needs to be updated, following by a system upgrade.

sudo pacman -Sy archlinux-keyring
sudo pacman -Su

Last edited by brianrobt (2025-07-01 14:19:41)

---

Best regards,

Brian

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,359

Re: [SOLVED] Unable to Install nodejs: Corrupted Package (unknown GPG key)

Update archlinux-keyring, then do a full system update.

Edit: for the record, this is not a "corrupt GPG key", and nothing in that output says that it is.

Last edited by Scimmia (2025-06-30 13:31:01)

brianrobt

Member

From: St. Louis, MO

Registered: 2024-05-18

Posts: 2

Re: [SOLVED] Unable to Install nodejs: Corrupted Package (unknown GPG key)

Ah, thanks @Scimmia.  That worked.  I tried doing a simple update first, which failed.  Then I tried removing and re-initializing the keyrings, which worked.

Didn't work:

sudo pacman -S archlinux-keyring
sudo pacman -Syu

Worked:

# Remove old keyrings
sudo rm -rf /etc/pacman.d/gnupg

# Reinitialize keyring
sudo pacman-key --init

# Populate with Arch Linux keys
sudo pacman-key --populate archlinux

# Update the keyring package
sudo pacman -S archlinux-keyring

sudo pacman -Syu

---

Best regards,

Brian

gromit

Administrator

From: Germany

Registered: 2024-02-10

Posts: 1,445

Website

Re: [SOLVED] Unable to Install nodejs: Corrupted Package (unknown GPG key)

Didn't work:

sudo pacman -S archlinux-keyring
sudo pacman -Syu

The correct version would have been:

sudo pacman -Sy archlinux-keyring
sudo pacman -Su