# Description
Currently, the error on a failing package integrity check looks like this:
```
:: Retrieving packages...
syncthingtray-1.5... 729.7 KiB 1208 KiB/s 00:01 [###########################] 100%
(1/1) checking keys in keyring [###########################] 100%
(1/1) checking package integrity [###########################] 100%
error: syncthingtray: signature from "Martchus martchus@gmx.net" is unknown trust
:: File /var/cache/pacman/pkg/syncthingtray-1.5.3-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] n
error: failed to commit transaction (invalid or corrupted package (PGP signature))
Errors occurred, no packages were upgraded.
```
This suggests that the package is invalid or corrupted which is also most likely the case. However, it can also be that just the signature has expired and needs to be refreshed - which was actually the case here. It took me a few minutes to figure this out as only invoking `gpg --verify` manually on the package revealed a good error message. This also confused other users (see https://github.com/Martchus/syncthingtray/issues/258 and https://aur.archlinux.org/packages/c++utilities#comment-972000).
# Suggestions
It would be enough to print an additional note like `gpg --verify` does that the key in question has expired (or whatever additional information is available). The output of gpg looks like this:
```
gpg: Signature made Sun Apr 28 14:29:34 2024 CEST
gpg: using RSA key B9E36A7275FC61B464B67907E06FE8F53CDC6A4C
gpg: Good signature from "Martchus " [expired]
gpg: aka "Marius Kittler " [expired]
gpg: Note: This key has expired!
Primary key fingerprint: B9E3 6A72 75FC 61B4 64B6 7907 E06F E8F5 3CDC 6A4C
```
The note makes is quite clear what the problem is. Of course it would also be great to point out how to refresh the key in case it has expired (e.g. linking to a section on https://wiki.archlinux.org/title/Pacman/Package_signing). It looks like the best way to do this is https://github.com/Martchus/syncthingtray/issues/258#issuecomment-2100843183 but I'm not sure why/when the deletion is necessary.
↧
