[SOLVED] Error: bmake: signature from "Ivy Foster <i@iff.ink>"is marg

CodeAsm · 2022-01-12 22:11:08

While doing a system update, I stumbled upon 1 package "bmake" that is signed by Ivy Foster
it failed (my question is below in bold)

error: bmake: signature from "Ivy Foster <i@iff.ink>" is marginal trust
:: File /var/cache/pacman/pkg/bmake-20211221-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).

Now I dont really need this package, but with my somewhat limited knowledge of pgp (gnupg) I see this person is responsible for various packages in the community section and even seems to have a archlinux.org mail.

Am i reading this right, is this particular signature signed with outdated arch master keys, and thus "marginal" trusted? im Dutch, my english might not be completely fine. I hope my thoughts are somewhat be able to make sense.

https://bbs.archlinux.org/viewtopic.php … 4#p1760824 suggested some thing i tried, like listing all keys from Ivy (a bunch showed up,

[snip]
pub ed25519 2021-10-27 [SC] [expires: 2026-10-26]
DB5B4A9546601F945389C66940AC6F48D55AB11D
[snip
uid [marginal] Ivy Foster <iff@archlinux.org>
sig 3 40AC6F48D55AB11D 2021-10-27 Ivy Foster <i@iff.ink>
sig A88E23E377514E00 2021-11-21 Florian Pritz (Arch Linux Master Key) <florian@master-key.archlinux.org>
sig 4DC95B6D7BE9892E 2021-11-10 David Runge (Arch Linux Master Key) <dvzrv@master-key.archlinux.org>
uid [ unknown] Ivy Foster <iff@iff.ink>
[snip]

These master keys have expired I guess, so might explain a "marginal" trust. I translated this word and looked up the meaning. some like its close, near a edge. so we could trust it, but somethings are off.

the actual link i posted above translates to removing all keys, and then repopulating them with all known and new keys. I did this, and all returned as before I think. still not fixed bmake install.

Question: Does Ivy Foster or someone else need to update their trust in Ivy Fosters key/signatures?
or do I as a user need to perform a certain trust.

I dont think I really need bmake for anything (checked if anything depends on it, nope). I think I installed it for some tests i tried on bsd code that ended up not compiling anyway. (silly me forgot to remove bmake, it was last year, so yeah, key would have been within the time period).

Sorry if this is a long post, I feel like a noob, but at the same time this might be important to someone, or the 24 packages Ivy maintains. Thanks for reading and many thanks for possibly a helpfull reply. for now, I might just uninstall bmake.

Last edited by CodeAsm (2022-01-13 11:30:30)

Allan · 2022-01-12 22:25:37

They have not expired, but each packager key needs signed by three master keys.

$ pacman -Sii bmake | grep Signat
Signatures : 40AC6F48D55AB11D E32BCD9358A65AE0

So for some reason this is signed by two keys, yet only one has the required trust.

loqs · 2022-01-12 22:30:45

There has been a new release of bmake to address the issue bmake 20211221-2 https://github.com/archlinux/svntogit-c … 9aae83ebf6
Edit:

pacman-key --list-keys 40AC6F48D55AB11D E32BCD9358A65AE0
gpg: Note: trustdb not writable
pub   rsa4096 2012-07-31 [SC] [expires: 2024-01-21]
      CB33B736591A9CA06098A9A5FCAC9CF5A6EE1209
uid           [ unknown] Ivy Foster <i@iff.ink>
uid           [  full  ] Ivy F. Foster <ivy.foster@gmail.com>
uid           [  full  ] Ivy F. Foster <iff@escondida.tk>
uid           [  full  ] Ivy Foster (For MLs) <joyfulgirl@archlinux.us>
uid           [ unknown] Ivy F. Foster <i@escondida.tk>
uid           [ unknown] Ivy F. Foster <if@escondida.tk>
uid           [ unknown] Ivy F. Foster <ivy@escondida.tk>
uid           [ unknown] Ivy F. Foster <code@escondida.tk>
uid           [ unknown] Ivy F. Foster <escondida@escondida.tk>
uid           [ unknown] Ivy F. Foster <if@iff.ink>
uid           [ unknown] Ivy F. Foster <iff@iff.ink>
uid           [ unknown] Ivy F. Foster <ivy@iff.ink>
uid           [ unknown] Ivy F. Foster <code@iff.ink>
uid           [ unknown] Ivy Foster <escondida@iff.ink>
uid           [ unknown] Ivy F. Foster <iff@archlinux.org>
sub   rsa4096 2012-07-31 [E] [expires: 2024-01-21]
sub   rsa4096 2012-09-03 [S] [expires: 2024-01-21]

pub   ed25519 2021-10-27 [SC] [expires: 2026-10-26]
      DB5B4A9546601F945389C66940AC6F48D55AB11D
uid           [  undef ] Ivy Foster <i@iff.ink>
uid           [ unknown] Ivy Foster <code@iff.ink>
uid           [ unknown] Ivy Foster <dev@iff.ink>
uid           [ unknown] Ivy Foster <escondida@iff.ink>
uid           [ unknown] Ivy Foster <f@iff.ink>
uid           [ unknown] Ivy Foster <if@iff.ink>
uid           [marginal] Ivy Foster <iff@archlinux.org>
uid           [ unknown] Ivy Foster <iff@iff.ink>
uid           [ unknown] Ivy Foster <ivy.foster@gmail.com>
uid           [ unknown] Ivy Foster <lists@iff.ink>
uid           [ unknown] Ivy Foster <r@iff.ink>
sub   cv25519 2021-10-27 [E] [expires: 2026-10-26]

Mismatch in the uid used for signing vs that which is trusted?

Last edited by loqs (2022-01-12 22:46:46)

CodeAsm · 2022-01-13 11:29:57

Thanks
Guess its fixed. not fully understand it all but this will do for now.

Arch Linux

#1 2022-01-12 22:11:08

[SOLVED] Error: bmake: signature from "Ivy Foster <i@iff.ink>"is marg

#2 2022-01-12 22:25:37

Re: [SOLVED] Error: bmake: signature from "Ivy Foster <i@iff.ink>"is marg

#3 2022-01-12 22:30:45

Re: [SOLVED] Error: bmake: signature from "Ivy Foster <i@iff.ink>"is marg

#4 2022-01-13 11:29:57

Re: [SOLVED] Error: bmake: signature from "Ivy Foster <i@iff.ink>"is marg

Board footer