How to Fix EXPKEYSIG Error on Arch Linux

If you're using Arch Linux and you've encountered the EXPKEYSIG error, it means that a repository's GPG key has expired. This guide will help you update the key to keep your system running smoothly.

Understanding the EXPKEYSIG Error

The EXPKEYSIG error indicates that the GPG key used to verify the packages from a repository has expired. This verification process ensures that the packages you install are authentic and secure.

Example Error Message

error: nginx: key "0123456789ABCDEF" is expired

Step-by-Step Guide to Fix EXPKEYSIG Error on Arch Linux

1. Identify the Expired Key

First, identify the key ID from the error message. In the example above, the key ID is 0123456789ABCDEF.

2. Fetch the Updated Key

Use the following command to fetch the updated key from a key server. Note that Arch Linux uses pacman-key for managing keys.

sudo pacman-key --recv-keys 0123456789ABCDEF

3. Sign the Updated Key

After fetching the updated key, you need to locally sign it to trust the key.

sudo pacman-key --lsign-key 0123456789ABCDEF

4. Update Your System

Finally, update your system to apply the changes.

sudo pacman -Syu

Handling Specific Keyring Files

Some repositories might specify their GPG keys directly in their configuration files. Here’s how to handle these cases.

Example: Updating the Arch Linux Keyring

  1. Identify the Key ID

    Find the key ID in the error message. For example, 9DC858229FC7DD38854AE2D88D81803C0EBFCD88.

  2. Fetch the Updated Key

    sudo pacman-key --recv-keys 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

  3. Sign the Updated Key

    sudo pacman-key --lsign-key 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

  4. Update Your System

    sudo pacman -Syu

General Steps for Any Repository with Pinned Keys

For repositories that specify their keys, follow these steps:

  1. Identify the Key ID

    Find the key ID in the error message or repository documentation.

  2. Fetch the Updated Key

    sudo pacman-key --recv-keys <KEY_ID>

  3. Sign the Updated Key

    sudo pacman-key --lsign-key <KEY_ID>

  4. Update Your System

    sudo pacman -Syu

Complete Example: Updating a Custom Repository Key

Suppose you have a custom repository configured like this:

[custom-repo]
Server = https://example.com/arch/$repo/$arch
SigLevel = PackageRequired

  1. Identify the Key ID

    Assume the key ID is 1234567890ABCDEF.

  2. Fetch the Updated Key

    sudo pacman-key --recv-keys 1234567890ABCDEF

  3. Sign the Updated Key

    sudo pacman-key --lsign-key 1234567890ABCDEF

  4. Update Your System

    sudo pacman -Syu

By following these steps, you can resolve the EXPKEYSIG error on your Arch Linux system, ensuring your repositories remain functional and secure.

Conclusion

The EXPKEYSIG error can be a bit frustrating, but it's essential for maintaining the security and integrity of your package management on Arch Linux. Regularly updating your GPG keys and following the latest methods will keep your system safe and up-to-date. If you encounter this issue, refer back to this guide for a straightforward solution.