Invalid PGP Signature when updating packages in MSYS2 - Despite fixes - windows

Ever since June 2020, I have been unable to update my packages with pacman -Syu. When I try, I get the following error:
(It gets up to "Checking package integrity", then shows errors like this for every single package)
error: gcc-libs: signature from "David Macek <david.macek.0#gmail.com>" is unknown trust
:: File /var/cache/pacman/pkg/gcc-libs-10.2.0-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]
Now, helpfully, MSYS2 does have a post explaining why this occurred and how to fix it: https://www.msys2.org/news/#2020-06-29-new-packagers
However, despite following all of those steps, nothing changed and I get the same errors.
For clarity, I did the following:
curl -O http://repo.msys2.org/msys/x86_64/msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz
curl -O http://repo.msys2.org/msys/x86_64/msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz.sig
pacman-key --verify msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz.sig
pacman -U msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz
Those "worked" (no errors) but didn't fix anything, so I tried:
rm -r /etc/pacman.d/gnupg/
pacman-key --init
pacman-key --populate msys2
But that didn't accomplish anything either.
What do I do?

The original key updating procedure News-MSYS2 can be made to work by adding one more command:
$ pacman-key --keyserver keyserver.ubuntu.com --refresh-keys
The packager's key as delivered in msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz has expired, and needs to be refreshed.
pub rsa4096 2018-01-14 [SC] [expired: 2021-06-19]
87771331B3F1FF5263856A6D974C8BE49078F532
uid [ expired] David Macek <david.macek.0#gmail.com>
Unfortunately, the keyserver used by older version of pacman-key command is not valid anymore.
$ pacman-key --refresh-keys
gpg: error retrieving 'alexey.pawlow#gmail.com' via WKD: No data
gpg: error reading key: No data
gpg: refreshing 1 key from hkps://hkps.pool.sks-keyservers.net
gpg: keyserver refresh failed: No name
==> ERROR: Could not update key: F40D263ECA25678A
Keyserver value in newer pacman-key was changed to keyserver.ubuntu.com by this msys2/MSYS2-keyring commit. Hence, the explicit --keyserver option for the pacman-key command at the beginning of this answer.

This worked for me. From "Nulano":
pacman -S msys2-keyring
Then use pacman -Syu as normal.
Tried the solutions at Msys 2020-06-29 - new packagers. Didn't work for me.

After trying a few other things (like disabling sourceforge mirrors) I found none worked.
Instead, I downloaded the latest tar of the project (since I cannot run the .exe) which is located at:
http://repo.msys2.org/distrib/msys2-x86_64-latest.tar.xz
Once downloaded, I went into C:/msys64/ and made a copy of the /home folder, then deleted all of the contents.
I then copied in the latest from the tar into there, and finally copied the /home folder back.
Now, MSYS2 finally works properly again. Though it does mean installing all packages over again.

Related

gpg verify of GNU Emacs download fails - Did I do it correctly?

I have downloaded a GNU tar archive (emacs-26.1.tar.xz) and now want to verify it against its signature file. gpg returns with the verify option the following output:
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Obviously the download could not be verified. But what does this mean? Is the tar archive probably corrupt? Or had I not imported the correct keys?
Here is step-by-step what I did:
I downloaded the archive file and its .sig file:
$ wget https://ftp.gnu.org/gnu/emacs/emacs-26.1.tar.xz
$ wget https://ftp.gnu.org/gnu/emacs/emacs-26.1.tar.xz.sig
I downloaded the GNU keyring (the Emacs download page gave me the link):
$ wget https://ftp.gnu.org/gnu/gnu-keyring.gpg
With gpg I imported the GNU keyring:
$ gpg --import gnu-keyring.gpg
Note that this returned:
.
.
.
gpg: Total number processed: 525
gpg: imported: 525 (RSA: 187)
gpg: no ultimately trusted keys found
Finally I verified the tar archive:
gpg --verify emacs-26.1.tar.xz.sig emacs-26.1.tar.xz
This then returned (as stated at the top):
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
So, is the tar archive corrupt or had I not imported the correct keys? If the latter is the case, what are the correct keys for this GNU download?

Cannot build open-source project

I'd like to contribute to an OSS project built with go, but I'm having hard time compiling it. It looks as if I'm missing something obvious.
I think the problem is related to how go is installed on my computer, and not to the project itself, thus I'm posting it here on StackOverflow, instead of project's "Issues" section.
Below is what I'm doing.
I've installed go using homebrew:
$ brew install go
Updating Homebrew...
==> Auto-updated Homebrew!
Updated 1 tap (homebrew/core).
==> Updated Formulae
libebml
==> Downloading https://homebrew.bintray.com/bottles/go-1.8.3.sierra.bottle.tar.gz
Already downloaded: /Users/gmile/Library/Caches/Homebrew/go-1.8.3.sierra.bottle.tar.gz
==> Pouring go-1.8.3.sierra.bottle.tar.gz
==> Caveats
A valid GOPATH is required to use the `go get` command.
If $GOPATH is not specified, $HOME/go will be used by default:
https://golang.org/doc/code.html#GOPATH
You may wish to add the GOROOT-based install location to your PATH:
export PATH=$PATH:/usr/local/opt/go/libexec/bin
==> Summary
🍺 /usr/local/Cellar/go/1.8.3: 7,035 files, 282.0MB
$
Then I cloned the repo:
$ hub clone lucapette/fakedata
I ran make setup (per instruction), which at first did not complete successfully:
$ make setup
go get -u github.com/alecthomas/gometalinter
gometalinter --install
make: gometalinter: No such file or directory
make: *** [setup] Error 1
$
I figured that is because gometalinter is nowhere in my $PATH, so have added it (I'm using fish-shell):
$ set fish_user_paths /Users/gmile/go/bin
running make setup seem to have succeeded now. This is the output:
$ make setup
go get -u github.com/alecthomas/gometalinter
gometalinter --install
Installing:
aligncheck
deadcode
dupl
errcheck
gas
goconst
gocyclo
goimports
golint
gosimple
gotype
ineffassign
interfacer
lll
megacheck
misspell
safesql
staticcheck
structcheck
unconvert
unparam
unused
varcheck
$
Running make build fails:
$ make build
go build
main.go:11:2: cannot find package"github.com/lucapette/fakedata/pkg/fakedata" in any of:
/usr/local/Cellar/go/1.8.3/libexec/src/github.com/lucapette/fakedata/pkg/fakedata (from $GOROOT)
/Users/gmile/go/src/github.com/lucapette/fakedata/pkg/fakedata (from $GOPATH)
main.go:12:2: cannot find package "github.com/spf13/pflag" in any of:
/usr/local/Cellar/go/1.8.3/libexec/src/github.com/spf13/pflag (from $GOROOT)
/Users/gmile/go/src/github.com/spf13/pflag (from $GOPATH)
make: *** [build] Error 1
$
So either Contributing guideline is incomplete, or I'm missing something obvious about installing and managing go packages.
Your path when cloning the source must be on the golang PATH like :
/home/gujarat/golang/src/github.com/lucapette/fakedata
as you can see my Path to golang path is : /home/gujarat/golang/.
You can also print your golang path in your terminal by entering : $GOPATH.
And the git clone should be in the following the exact as above path : src/github.com/lucapette/.
cd $GOPATH/src/github.com/
mkdir lucaptte
cd lucapette
git clone https://github.com/lucapette/fakedata.git
When you are running the make command which trigger go build this command will look the $GOPATH and your $GOROOT folder.
Your go source should in your gopath - here it is Users/gmile/src. Use go get to fetch the pkg you want to work on instead and it should work.

Issues while importing public pgp key though gpg

BACKGROUND: We had pgp software installed on old servers but on our new servers the infrastructure team installed gpg. So we have to do everything using gpg tool now. I am new to this.
So when we try to import a PGP public key block using the gpg import command we get the following error
>gpg --import /<filepath>/PGPKey.asc --user xyzzzd
gpg: Warning: using insecure warning!
gpg please see http://www.gnupg.org/faq.html for more inoformation
gpg key 0DBC987k: "zyzzd <pgpadmin#xyprod.#####.com>" not changed
gpg can't open '--user':No such file or directory
gpg can't open 'xyzzzd':No such file or directory
gpg Total number processed: 1
gpg unchanged: 1
Note we have placed the PGPKey.asc in the temp directory and the commands have been executed from that directory
There is no --user option in GnuPG, especially not for --import which expects all further arguments to be files to be imported; and I could neither find one for PGP.
The message says that the key 0DBC987k was already successfully imported into the GnuPG keyring, and no files could be found for --user nor xyzzzd.
Very likely you're fine just removing --user xyzzzd, otherwise you'll have to explain in detail what you're trying to achieve.

Invoke MSYS2 Shell from Command Prompt or PowerShell

Starting from Command Prompt or PowerShell (either is fine; I can figure out how to do the other given one), how can I invoke the MSYS2 shell to run a command?
More specific issue
I'm including this information to avoid an XY problem, but I strongly believe this is best solved by the answer to the above (more general) question.
In particular, I'm hoping to write a shell script to update the packages listed in Part III, Step 3 here. So I need something like:
[invoke msys2 bash] -c "pacman -Sy --needed msys2-runtime"
Calling the bash executable directly doesn't work:
C:\>C:\msys64\usr\bin\bash.exe -c "pacman -Sy --needed msys2-runtime"
/usr/bin/bash: pacman: command not found
I assume it's an environment problem. Changing PATH to include the path to MSYS2's bin directory doesn't fix the problem either. When it tries to install a package, bad things happens (nano is just an example):
C:\>bash -c "pacman -Sy --needed --noconfirm nano"
:: Synchronizing package databases...
mingw32 is up to date
mingw64 is up to date
msys is up to date
resolving dependencies...
looking for conflicting packages...
Packages (1) nano-2.3.6-2
Total Installed Size: 1.81 MiB
Net Upgrade Size: 0.17 MiB
:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [########################################################] 100%
(1/1) checking package integrity [########################################################] 100%
(1/1) loading package files [########################################################] 100%
(1/1) checking for file conflicts [########################################################] 100%
(1/1) checking available disk space [########################################################] 100%
(1/1) upgrading nano [########################################################] 100%
error: command (/usr/bin/bash /usr/bin/bash -c . /tmp/alpm_shqjUE/.INSTALL; post_upgrade 2.3.6-2 2.3.2-1 ) failed to execute correctly
Trying to invoke the batch file (C:\msys64\msys2_shell.bat) opens a new shell in a new window, which leaves me not knowing whether it failed or succeeded.
So how can I get the shell into MSYS2's normal state?
We're working hard to fix our messy update procedure, we want it to be trouble-free.
You can see some examples of how we invoke MSYS2 from a batch file when we create a new installer in:
https://github.com/Alexpux/MSYS2-packages/blob/master/msys2-installer/make-msys2-installer.bat
But as #StevenPenny suggests,
bash -l -c "pacman ..."
is the correct way.

Bad Exit Status from rpmbuild on Mac OSX

I'm working on packaging up some work into an rpm. I am doing this on Mac OSX after brew installing rpm. I have a basic .spec file, but I am getting an error and have been unable to diagnose it:
$ rpmbuild -ba myapp.spec
Executing(%prep): %{__spec_prep_cmd} /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.14478
error: Bad exit status from /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.14478 (%prep)
RPM build errors:
Bad exit status from /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.14478 (%prep)
The spec files is as follows:
Name: myapp
Version: 0.1.0
Release: 1
Summary: Web service to do stuff
URL: http://myapp.com
BuildRoot: %{_tmppath}/myapp-build-root
%description
My app
%prep
%build
%install
%pre
%preun
%postun
%clean
%files
%defattr(-,www-data,www-data,-)
%doc
This is my first time building an rpm, what am I doing wrong, and how can I fix this. Thanks in advance!
I ran into the same issue today. For no obvious reason the %prep macro fails, even without any content.
Running your spec on my Ubuntu box seems to work just fine after adding those two values:
License: yourLicense
Group: yourGroup
I have reason to believe, that rpm didn't get installed correctly on my box via homebrew. I think I aborted the process at some point, then forgot about it over lunch, but rpmbuild was available to use from within my script and I ran into the issue above.
I will try doing a clean install of the rpm formula in verbose mode to see whether my assumption is correct.
Update:
I've installed rpm successfully, but it took an awful long time:
/usr/local/Cellar/rpm/5.4.10: 187 files, 9.7M, built in 92.4 minutes
Nevertheless, it keeps on failing with the same error
rpmbuild -ba so.spec
Executing(%prep): %{__spec_prep_cmd} /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.69701
error: Bad exit status from /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.69701 (%prep)
With the content of /usr/local/Cellar/rpm/5.4.10/var/tmp/rpm-tmp.69701 saying:
%{__spec_prep_template}%{__spec_prep_post}

Resources