Fix pacman "signature from ... is unknown trust" and "invalid or corrupted package (PGP signature)"

sudo pacman -Sy archlinux-keyring
sudo pacman -Su

What the error means

During sudo pacman -Syu, after the download step:

(312/312) checking package integrity
error: python-requests: signature from "Some Packager <[email protected]>" is unknown trust
:: File /var/cache/pacman/pkg/python-requests-2.32.5-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] y
error: failed to commit transaction (invalid or corrupted package (PGP signature))
Errors occurred, no packages were upgraded.

Every Arch package is signed by a packager. pacman checks that signature against its own GnuPG keyring in /etc/pacman.d/gnupg/, which trusts packager keys because they are signed by the Arch master keys. Those keys are delivered by the archlinux-keyring package. The messages map to causes:

Answer Y to "Do you want to delete it?": the cached file is useless and will be downloaded again.

Fix 1: update archlinux-keyring (most common)

Systems that have not been upgraded for a few weeks or months hit this almost every time. The keyring package is designed to be updated first:

sudo pacman -Sy archlinux-keyring
sudo pacman -Su

This works because the keyring package's install script imports and trusts the new keys before the rest of the upgrade is verified. Run the two commands back to back; stopping after -Sy leaves a partial upgrade. Current Arch installs also run archlinux-keyring-wkd-sync.timer, which refreshes keys weekly; make sure it is enabled:

systemctl status archlinux-keyring-wkd-sync.timer
sudo systemctl enable --now archlinux-keyring-wkd-sync.timer

Fix 2: reinitialise and repopulate the keyring

If the keyring package itself fails to install, or pacman-key prints GnuPG errors (trustdb problems, keybox errors), rebuild the keyring from the installed keyring package:

sudo pacman-key --init
sudo pacman-key --populate archlinux
sudo pacman -Sy archlinux-keyring
sudo pacman -Su

--init creates a local master key if missing, and --populate imports and trusts the keys shipped in /usr/share/pacman/keyrings/. If that still fails, move the old keyring aside and start fresh:

sudo mv /etc/pacman.d/gnupg /etc/pacman.d/gnupg.bak
sudo pacman-key --init
sudo pacman-key --populate archlinux
sudo pacman -Sy archlinux-keyring
sudo pacman -Su

Fix 3: the keyring package is too old to verify the new keyring

After a very long time without updates, the new archlinux-keyring may be signed by a key your old keyring does not know, so Fix 1 fails with the same error. You can install just the keyring package with signature checking turned off through a temporary config file:

sed -e 's/^SigLevel.*/SigLevel = Never/' /etc/pacman.conf > /tmp/pacman-nosig.conf
sudo pacman -Sy --config /tmp/pacman-nosig.conf archlinux-keyring
rm /tmp/pacman-nosig.conf
sudo pacman -Su

A safer alternative on a very outdated system is to boot a current Arch ISO, whose keyring is up to date, mount your system and run pacman -Sy archlinux-keyring && pacman -Su inside arch-chroot, as described in the Arch install guide.

Fix 4: "signature is invalid": clock, cache or mirror

An invalid (not untrusted) signature means the data does not match. Check in this order:

# 1. clock: a date far in the past or future breaks GnuPG checks
timedatectl
sudo timedatectl set-ntp true
# 2. remove possibly corrupted cached packages
sudo pacman -Scc
# 3. refresh the mirror list (reflector is in the official repos)
sudo reflector --latest 20 --protocol https --sort rate --save /etc/pacman.d/mirrorlist
sudo pacman -Syyu

A mirror that is out of sync can serve a package whose signature belongs to a different build. -Syy forces a fresh database download after switching mirrors. A proxy or captive portal that rewrites downloads produces the same symptom.

Distro-specific notes

• Manjaro has its own keyring and packagers: sudo pacman -Sy archlinux-keyring manjaro-keyring, and repopulate with sudo pacman-key --populate archlinux manjaro.
• EndeavourOS adds endeavouros-keyring; populate with sudo pacman-key --populate archlinux endeavouros.
• Third-party repos (chaotic-aur, archzfs) need their key imported and locally signed: sudo pacman-key --recv-keys KEYID then sudo pacman-key --lsign-key KEYID, using the key ID from the project's own page.
• AUR packages that fail with unknown public key during makepkg are a different problem: the source signature key must be in your user's GnuPG keyring (gpg --recv-keys KEYID), not pacman's.
• On Debian and Ubuntu the equivalent is a repository key problem; see NO_PUBKEY.

How to prevent it

• Upgrade with sudo pacman -Syu at least every couple of weeks; Arch is designed for regular updates. The Arch Linux reference covers routine maintenance.
• Keep archlinux-keyring-wkd-sync.timer enabled and the clock synced with NTP.
• Read Arch news before big upgrades; keyring changes requiring manual steps are announced there.
• If an upgrade fails with a lock error instead, see "unable to lock database".

Frequently asked questions