signature from "Alexey Pavlov (Alexpux) <alexpux@gmail.com>" is invalid

[eyal0]

I'm getting many errors about invalid signatures in my CI:

2020-12-30T07:53:10.1381061Z error: mingw-w64-x86_64-icu: signature from "Alexey Pavlov (Alexpux) <alexpux@gmail.com>" is invalid
2020-12-30T07:53:10.1382702Z :: File /var/cache/pacman/pkg/mingw-w64-x86_64-icu-68.2-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
2020-12-30T07:53:10.1395297Z Do you want to delete it? [Y/n] error: mingw-w64-x86_64-boost: signature from "Alexey Pavlov (Alexpux) <alexpux@gmail.com>" is invalid
2020-12-30T07:53:10.1396779Z 
2020-12-30T07:53:10.1398296Z :: File /var/cache/pacman/pkg/mingw-w64-x86_64-boost-1.75.0-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
2020-12-30T07:53:10.1416780Z Do you want to delete it? [Y/n] error: mingw-w64-x86_64-harfbuzz: signature from "Alexey Pavlov (Alexpux) <alexpux@gmail.com>" is invalid
2020-12-30T07:53:10.1418414Z 
2020-12-30T07:53:10.1419562Z :: File /var/cache/pacman/pkg/mingw-w64-x86_64-harfbuzz-2.7.3-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
2020-12-30T07:53:10.1420770Z Do you want to delete it? [Y/n] error: failed to commit transaction (invalid or corrupted package)
2020-12-30T07:53:10.1731366Z 
2020-12-30T07:53:10.1734005Z Errors occurred, no packages were upgraded.
2020-12-30T07:53:10.1797630Z ##[error]The process 'C:\windows\system32\cmd.exe' failed with exit code 1

Similar to these: Alexpux/MSYS2-pacman#58

Is it a problem only in this repo or in all of msys2 or all of pacman?

[umarcor]

It sounds stupid but... did you try restarting the CI workflow?

[lazka]

some packages got incorrectly replaced and the package caching in setup-msys2/pacman doesn't like that. should be fixed in the next upload

stupid workaround: reorder the packages in the "install: " part of the setup-msys2 action, that will trigger a cache miss.

[eyal0]

That seems to have worked.

So why is setup-msys2 caching a broken result? Is it possible that this project is caching results before first confirming that they are successful?

[lazka]

We restore /var/cache/pacman/pkg/mingw-w64-x86_64-harfbuzz-2.7.3-1-any.pkg.tar.zst, pacman tries to download harfbuzz, sees it's already there and tries to use it, checks its signatures (in the DB), which fails because the signature was created for a different file.

Ideally pacman should verify the checksum of the file, see that it doesn't match and re-download the file from the mirror.

Might be worth filing a pacman bug report about that.

But ideally we should just handle this in the repo update step, so files don't get replaced in the future.

[eyal0]

Sure, let's file that bug! I'm new to msys2. Can you help me with that?

[lazka]

thanks, but pacman is developed by Arch Linux developers and we have forked it for msys2, so it's better if we file a bug ourselves.

[selsta]

Still seems to fail for me after reordering: https://github.com/monero-project/monero-gui/pull/3286/checks?check_run_id=1627423478

[eyal0]

Re-ordering worked for me once but now it's failing again and re-ordering isn't working for me now.

[eyal0]

Can there be a test in CI that will cover this situation?

[lazka]

I guess then the DB and files are out of sync. hopefully fixed in the next upload

[eyal0]

The workaround is easy enough: Take everything out of the install: line and put it in a new step like this:

    - name: pacman
      if: matrix.os == 'windows'
      run: pacman --noconfirm -S --needed mingw-w64-x86_64-gtkmm git base-devel bash mingw-w64-x86_64-gcc mingw-w64-x86_64-boost mingw-w64-x86_64-cairo

[umarcor]

@eyal0 that works because you are changing the cache key, not because you removed the install field. That is, if you had added any dummy package to the field, it would have worked too. It does not compare against the latest key only, but against all the different keys that were used in the repo. See https://github.com/msys2/setup-msys2/blob/master/main.js#L96-L105.