Repository navigation
Refresh archlinux-keyring for old keyrings #2213
Description
Since archinstall is included on the default archlinux installation media, it would be common for arch uses to keep an old usb drive with arch installation media on hand for emergency recovery. Also with tools like ventoy it is more popular to keep a usb drive full of isos as a toolkit.
As these Arch isos age, the keyrings they come with expire leading to failures to install packages in the middle of the archinstall script - after destructive steps like disk partitioning and filesystem creation have been completed. The simplest solution is to reboot into the arch install media, run pacman -S archlinux-keyring, then run archinstall, but new users might not know this and the user might not have access to a secondary device to easily look up commands.
Archinstall could prevent this problem by refreshing the archlinux-keyring early in the script, or at least to offer the option to refresh the keyring before a point of no return.
Activity
Torxed commentedon Nov 13, 2023
There's an automated key-ring-update-service called archlinux-keyring-wkd-symc.service on the Arch ISO as of a couple of months ago.
The issue is the race condition of network not being up during it's first execution, delaying the update but a substantial amount.
The best way forward would be to stop monkey-patching
archinstallto deal with these things, as we've been battling this for years now. And it's a moving target.Instead, there's two things that should happen (from a personal perspective):
benmordecai commentedon Nov 13, 2023
When I initially made this comment I was working with the 2023.06 image and thought that it was basically my fault for using an old image, so it seemed like it would be simple to add a check but as I have learned more (with your comments as well) its clear this is much more complicated and I agree with you as to the approach. I updated to 2023.11.01 and found that I could not get the archinstall script to work at all and I ended up having to redownload the 2023.06 to get it working again and before running archinstall I manually ran
pacman-key --initandpacman -Sy archlinux-keyring. After that I was able to successfully install with the 2023.06 media.All this to say I agree that the main solution should probably be making the keyring init and update process bulletproof, which is out of the responsibility of this project.
Torxed commentedon Nov 13, 2023
The one thing I want to convey, and I truly mean this, I understand the frustration! And I agree that this is an issue - and I am pushing for change to get this fixed.
Throughout the years we've done everything from
pacman-key --inittopacman -Sy archlinux-keyringto removing gpg cache and what not. But ultimately it takes way too much time to maintain compared to putting the effort in to fixing the root cause.And one of them is that the signing keys expire before there's a new one in place, the second being that the auto-update feature is a good step in the right direction - but it's incomplete.
And I'll do what I can to push fixes for them. Sadly that takes time away from
archinstallso bare with me! :)benmordecai commentedon Nov 13, 2023
Well I must also convey my thanks that you volunteer to do this at all. I get a free operating system for nothing.
I am not sure if this would be possible to know in advance, but I wonder if it would be possible to have something like a way to know right as you call
archinstallthat the keyring is not in an OK state and give a warning. At that point the user could exit and remedy the issue or else proceed (perhaps for the purpose of generating a configuration for future use) without expectation that the script would succeed.That of course would depend on the script being able to know in advance that there is a problem with the keyring, which may be just as complicated as the cat and mouse game you are trying to avoid.
MassiveLotion commentedon Jan 6, 2024
Why is
archlinux-keyring-wkd-symc.servicenecessary? Why can'tpacman -Sy archlinux-keyringbe executed automatically as the first step inarchinstall?. Obviously there will be a network connection then, so it would never fail. Does executingpacman -Sy archlinux-keyringwhen it's not necessary break something?KDPRoss commentedon Mar 8, 2024
Just hit this and popped over to see if there was already an issue tracking this ... and manually installing
archlinux-keyringwas my workaround to get my installation moving forward ... that seems the straightforward solution to me?TomerGamerTV commentedon Jan 7, 2025
None of this works for me because arch Linux keeps failing to verify the keys, I ran every command here and it didn’t get fixed…
Torxed commentedon Jan 30, 2025
Should at least get you going
TomerGamerTV commentedon Feb 1, 2025
First two commands didn't work but the last ones seemed to work, I finally booted into my own arch install 🎉
Rainoutt commentedon Feb 18, 2025
The previous commands are not working on a new iso, even after updating the archlinux-keyring package, archinstall still frozes on "Waiting for Arch Linux Keyring (archlinux-keyring-wkd-sync) synchronization to complete."
radjanada commentedon Jan 23, 2026
I had a similar problem where i couldn't update archlinux-keyrings, i followed these steps by TomerGamerTV,:"
killall gpg-agent rm -rf /etc/pacman.d/gnupg pacman-key --init pacman-key --populate pacman -Sy archlinux-keyring", i had an issue with removing "/etc/pacman.d/gnupg", so i have unmounted it using "sudo umount -l /etc/pacman.d/gnupg`" then the rest went smoothly, thank you so much!
Softer commentedon Jun 10, 2026
This should be covered now. archinstall waits for the ISO's archlinux-keyring-wkd-sync to finish before starting (that service exists exactly to refresh expired keys on old media), and since #4577 a keyring/GPGME failure during the db sync triggers an automatic keyring reinit + retry - basically the killall gpg-agent / pacman-key --init / --populate dance from this thread, just done for you. I think this can be closed.