Arch Linux

Wmog

Member

Registered: 2017-09-13

Posts: 25

pacman -U and .sig files

Hey,

I found out a mechanism to add missed signature while upgrading (downgrading) packages and I do not understand why it works like that.

As I said, sometimes while upgrading or downgrading a package with

pacman -U

we encounter the error:

package missing required signature

For example:

sudo pacman -U https://archive.archlinux.org/packages/l/lib32-dbus/lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz
loading packages...
error: '/var/cache/pacman/pkg/lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz': package missing required signature

(Also, unlike what is stated in https://wiki.archlinux.org/index.php/Ar … rchive#FAQ : "Letting pacman fetch it will automatically download the package's detached .sig file and verify it according to /etc/pacman.conf settings.", it seem that in this case pacman does not automatically fetch  download the package's detached .sig file).

But when running (this time this is the the .sig file) :

sudo pacman -U https://archive.archlinux.org/packages/l/lib32-dbus/lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz.sig

the output is:

  lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz.sig                  310.0   B  0.00B/s 00:00 [###########################################] 100%
error: failed retrieving file 'lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz.sig.sig' from archive.archlinux.org : The requested URL returned error: 404
warning: failed to download https://archive.archlinux.org/packages/l/lib32-dbus/lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz.sig
loading packages...
error: '/var/cache/pacman/pkg/lib32-dbus-1.10.22-1-x86_64.pkg.tar.xz.sig': package missing required signature

However, it seems that the system well retrieved the signature and when running now the first command, the signature is not missing any more.

I read the pacman's man, and especially concerning the -U option, but I have found nothing that explains this behaviour.

Could you give me a robust explanation please?

Thank you in advance.

Last edited by Wmog (2018-05-25 18:07:17)

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: pacman -U and .sig files

The -U http://... option tries to download the package and the signature into the cache, and then install it.

It also, by default, enforces that signatures *must* exist, which is not the case when using -U /var/cache/pacman/pkg/...

The logic is slightly broken, though, when the package file itself is already cached, but the signature isn't. It's a known bug, to be honest.

It's an interesting question whether it should try downloading the signature, or not use the cache at all.

...

Your second command faked pacman out, it tried to use the sig file as a package, downloaded+cached it, failed to download .sig.sig, then got everything to be cached properly for the next time you tried to use the original command.
(If you'd disabled signature checking for remote files in your pacman.conf, you'd get a different error when it told you the package file was corrupted. Which is sort of true, since it was a sig file, not a package file...)

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

mpan

Member

Registered: 2012-08-01

Posts: 1,675

Website

Re: pacman -U and .sig files

pacman is a packages manager, not arbitrary files downloader. The -U option requires a package file as its target: either a path to the local file or a URL to such file.

https://archive.archlinux.org/packages/ … tar.xz.sig isn’t a package file, hence it fails. However, since the file itself exists, its download alone succeeds — at this stage pacman has no way to determine that you have passed it an invalid argument. In the next step it tries to download a signature for what it thinks is a package file, but fails — the server returns 404, because it doesn’t have a file that would be a signature for a signature. At this point everything breaks and the whole process is aborted.

Since a file has been downloaded to the cache, it stays there. Because it itself is a valid signature for “lib32-dbus-1.10.22-1-x86_64.pkg.tar”, pacman can use it later.

Last edited by mpan (2018-05-25 19:28:50)

---

Paperclips in avatars?