signature=45ee9a147674adfbd07cafca253c489b,Invalid or corrupted database (PGP signature) when updati...

It seems the downloaded key (https://archzfs.com/archzfs.gpg) has an extra sig in it.

pacman-key --list-sigs output before the manual input:

pub rsa2048 2018-07-09 [SC] [expires: 2023-02-03]

DDF7DB817396A49B2A2723F7403BD972F75D9D76

uid [ unknown] ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-17 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2019-04-21 Pacman Keyring Master Key

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

uid [ unknown] ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-09 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2019-04-21 Pacman Keyring Master Key

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

sub rsa2048 2018-07-09 [E] [expires: 2023-02-03]

sig 403BD972F75D9D76 2018-07-09 ArchZFS Bot

sig 403BD972F75D9D76 2020-02-04 ArchZFS Bot

pacman-key --list-sigs output after the manual input:

pub rsa2048 2018-07-09 [SC] [expires: 2023-02-03]

DDF7DB817396A49B2A2723F7403BD972F75D9D76

uid [ full ] ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-17 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2019-04-21 Pacman Keyring Master Key

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

sig 22C69579E1123CE6 2019-05-27 [User ID not found]

uid [ full ] ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-09 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2019-04-21 Pacman Keyring Master Key

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

sig 22C69579E1123CE6 2019-05-27 [User ID not found]

sub rsa2048 2018-07-09 [E] [expires: 2023-02-03]

sig 403BD972F75D9D76 2018-07-09 ArchZFS Bot

sig 403BD972F75D9D76 2020-02-04 ArchZFS Bot

That 22C69579E1123CE6 2019-05-27 [User ID not found] is new.

So, 1) this is legit and the key server is broken / not updating or 2) we've got a problem.

Any maintainer want to confirm this change? #346 seems to reference the key change and uses the long fingerprint to download / verify the key via the Wiki now. However, the PGP key mentioned in that issue is not the same as what's downloaded from archzfs.com . The key I get is:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFtDvKwBCADfjeYybNsoGu+NLUQHBQHlV8jfqQMqox/vZXiUD6dm4aWvOpL8

YTT+WWh9aBItUubci8/VK80rAhzB/graYNhBB6XIEnCtEJH5V6PsZIN09avvdIbD

I6jWnQ3s6LuPqVGWOoOxUbEtcnw8Ax+OU6eqZ9v3kMIkx3nXZaHWGDLjhFVW+CiZ

FqhXywQhgvi391KphDMK7daMLW5VphCaiVJbZ8VDoLiDH6X1sRITtgcOAiowT7js

Nl8z334d3Cy4FQ4vrAcPtQbBd2mQbDECLPXoWMTyh+JpYkPCBkF/CTawf8LhQcgs

eHtHt9S7rGtQgbGzuCShM/4g1g9q+GfDLKBHABEBAAG0IkFyY2haRlMgQm90IDxi

dWlsZGJvdEBhcmNoemZzLmNvbT6JAVcEEwEIAEECGwMFCwkIBwIGFQoJCAsCBBYC

AwECHgECF4ACGQEWIQTd99uBc5akmyonI/dAO9ly912ddgUCXjmV1QUJCJlzqQAK

CRBAO9ly912ddnRXB/4lrQTW2uSVp5EV8ZjVKQwhjVjTocH+JaxImm7h0V7NyeJg

vfjHOTZjnY5mZxdrj5Yo7+9n7/ZaBlwtpC/fgsFIAVJLBgOGqHOu3n8o1fvy25l2

isnDGLU+JWMh9RNvaeBeFWuP43JOuIUtrS/LD7GUCp9DQT8bG4Ek75AxSolqaVn3

HmEPK9J9vYG1JgZ1YgXlSWovrQQy6ruJiYzt9+ni2HmA3FYOHlVP9fQBwT2/yAeF

i0BigwdqVZ3OBGupfSQra01NjRg69RnzujxkYW46YVwjatFdp8N4UWGEvmjDiUoH

AtTojcx7cKIHHzQAP6wtJc4FlT2wVh6yGE2YbBhHiQIzBBABCAAdFiEE7+1GyEvR

Hdl5iZUsIsaVeeESPOYFAlzrNI4ACgkQIsaVeeESPOZWLg/+N+uUsB8ELWPUXiKV

IDuEoL07cyxYw7Ru2UW3sq/NT2/AkYuHmrXcYD8GYu3LKzzsbhAoUEYtGOX38X7y

N1gVOOb1wmjAP9NwgDJ7anqMxtogC3geplMXLs+Zv7EMS/UvvZf7wCqmhRI07jr8

ZZZOXaleLdPICnq9Wm1Ah4k/JGcAEolYuBsTPbPaox4J42+l0GuVEvlTiWnG0G3I

FhkvfeJPiaQJ/9aLiN6qExhJd5Az3Y0l/wq3Kjom31gJZLO4tHnXVoc/82JuIGJk

DZDWOC00FqmX5fiC3k6Tid6Mt5KNb6ySA0Uo4hRl1iQde6XlZVhRUECM+5W9Fsca

MlWr2VuuRDe16/UXtFB0UTlqsJmCg33SwwzxpOLHVpTm4HrBMCtxG7hEeCUpG19i

ps0D3AdWmltpNaUtA11yKBj69O9iMepgnmW6mGdpSiuj4khmmTKisfe/e56Tky6v

U1BrqrBmGv21uKfoeODKwrb36m5dMev6DSYxk0+94kNcS1iM7ZCVJ76JZ+KriSRW

Iwy0gvp6bnHs4AlNlZhcjapYyfF6zI26sc15NbEVd9p4HzYGp+NVR/MOuXLGtn2a

zGb4E1ENvKuB6OZ1N64Cs1Bnijkd3ZJU1PDxrTVmnWaQZtraL35OksyQMoGUk09u

XunNyRPz71jM0+BBQF0nXhJAzcW0HUFyY2haRlMgQm90IDxib3RAYXJjaHpmcy5j

b20+iQFUBBMBCAA+AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEE3ffbgXOW

pJsqJyP3QDvZcvddnXYFAl45leYFCQiZc6kACgkQQDvZcvddnXZuxQf/adXxZHW2

worxGHNDtFCmE7GscSYEL9DvgAT/pm7RikyfzzlypLde9adEYKVwHzEMR7aLxp1I

WEufg4H4jZIyhdeneuF8hJgYp0l1nGChSEKv76R13lfWuMlNCzAJZOyVNx7HJJHH

Cn1+T8wxROBpfPJTY/cuTNdd8md+7xHJWUtlFfhMwq4LvOvyZxGbUfoxQC1UlT70

SUBZCBPsePhzzQ0PyNRdYrV4ncGCQvIJ6niMwSBn4YjdGnQdDkTNqEuMk0lqT2/r

Pf6+oUm+j2i1ppQ8xgRQsXHFuDZ8GiBAei1NYfKE3GLq+/UuDTWsvqK7MbIFsp90

nMip7AZ1Tl1Ha4kCMwQQAQgAHRYhBO/tRshL0R3ZeYmVLCLGlXnhEjzmBQJc6zSY

AAoJECLGlXnhEjzmmn4P/iRwTZoo/8hg5lwiAvmOau3O5mmYiiQ5ruuy6Y8Gs1p+

QQFmXMnNI76TWeU+lAM26qd8hJAvKCcSyxR/vMtdnDdF4x+nw1oIFcWnX2T9cAwm

NLsui+byKpg5KyCux3zruwo+oUyGTa5JzjqSZAhRygrB4KvQ29Ja8aF84zlbWeRi

e3awHChoGKBAXpK+SKQS+UWRnUNVgrR+BaPhMvGKIU+Y6V5KPNPMy2JIx8sF5NMn

+VdsI0FUUWq2PDUSeCQrSgj4MdOw/WXWUj/z2PIrqn3xsd3cG6eif6zYNuymA8Wv

c1gi2IbjfN5mJwreYAgTVkVDATmyc9uGquQ+qPtyZfsD+jjepswbTGJWESyaq5bN

XR7ewbWPXxU9elxsKSlwSzLo3wIRKIEkySSOp10no5A6/D+W1eHQY/FnZfri/o3b

WoQkLD5qYabWLx/Yiq7f9hURlH86j+9fHeUTyJQSj+JlJYrfkozH5+EZjp2mDaQ3

bTbC6/N0OpX89DAZcVdHKrGtC9BAH5mlBAW2qouLwnST1q7Ssp7UxNFdllL95cCi

54KRz7QBm6U5JFUmv44Wm6bqHDznHJJ6+Hqd9dJtKs4s6iYVi8hOVm9bH3QyoZ5e

4ZQyziS8aAUysFsRY6ZKSzFTEn3GIjjGreqbNo43ymTHR3L18EJFo4/bLexGl/3D

uQENBFtDvKwBCADVX/D3KV3lIbzSqVQ0F+kgOXgLxGLT7zilnHbfJlqaYK5Ud03Y

uSdCntSTDzuzPe4s8VkFkcGKj0CypZLtyMXFBj7I7poqemv7tJKCwZO6n+JNtHYT

6cPehz1WpZEXXuZdPRzpUV1PJi59p0PYxmfe344p0U2LC9tpXoi/2JlOWI0yz/qb

zR8+qT7hnqmeHNhl2LqAcJcK+8ZgXWO5873Hi+ohrqyaO6zPzHZ6RB4VRq0glIQy

XIVgYf/JK0oMZMk53uxJm0Sbv3wtU4TzJTQVAf3hgzKJrCeRbZqJ2tovRpnpP8KN

iulQ2ARvcZZu5mLk4j3tgPSZzB9mu/mMVFBxABEBAAGJATwEGAEIACYCGwwWIQTd

99uBc5akmyonI/dAO9ly912ddgUCXjmV8AUJCJlzxAAKCRBAO9ly912ddg67B/wP

wFvhElxuRxeG3u30AvNRzVtBxE9NrlPZP55QVR5nsFygvPw5x2oiVG719E/qcWhV

vQc6o0y4GsQ4UeYBeQp64YWIdi4EaY4AttewvHO6CsDlDyAajfLqLnZqfcTP45Bj

o27S/4jyJHXgJddqeXds3Z2J1UWSXf+ff6fY1n1U5B0jLKx+//kPiv5CDTzxL3t9

QqX7NjZ7PnuZdwf63xYMQv0SshaJSh2KbUwfQNKTu4iiEqKan1b8GYndd0ofGQKH

F/G1Mw1StGBcX+zOP/AXDzUHgTkkFcL81bvWxG22BhRspyJtRuGeZ/pVsPzQa+oH

Z+mq8zzMmWtAVrMV5yKd

=0oT6

-----END PGP PUBLIC KEY BLOCK-----

gpg -v keyfile output for the above:

gpg: WARNING: no command supplied. Trying to guess what you mean ...

pub rsa2048/0x403BD972F75D9D76 2018-07-09 [SC] [expires: 2023-02-03]

Key fingerprint = DDF7 DB81 7396 A49B 2A27 23F7 403B D972 F75D 9D76

uid ArchZFS Bot

sig 0x403BD972F75D9D76 2020-02-04 [selfsig]

sig 0x22C69579E1123CE6 2019-05-27 [User ID not found]

uid ArchZFS Bot

sig 0x403BD972F75D9D76 2020-02-04 [selfsig]

sig 0x22C69579E1123CE6 2019-05-27 [User ID not found]

sub rsa2048/0x5E5B5EF0CBABFE0E 2018-07-09 [E] [expires: 2023-02-03]

sig 0x403BD972F75D9D76 2020-02-04 [keybind]

removing the key via sudo pacman-key -d DDF7DB817396A49B2A2723F7403BD972F75D9D76 and re-importing (sudo pacman-key -r DDF7DB817396A49B2A2723F7403BD972F75D9D76) and signing (sudo pacman-key --lsign-key DDF7DB817396A49B2A2723F7403BD972F75D9D76) gives me a different output than previously and the unknown sig is gone.

pacman-key --list-sigs now has:

pub rsa2048 2018-07-09 [SC] [expires: 2023-02-03]

DDF7DB817396A49B2A2723F7403BD972F75D9D76

uid [ full ] ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-17 ArchZFS Bot

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2020-07-09 Pacman Keyring Master Key

uid [ full ] ArchZFS Bot

sig 3 403BD972F75D9D76 2020-02-04 ArchZFS Bot

sig 3 403BD972F75D9D76 2018-07-09 ArchZFS Bot

sig L EEF32CC30FDF4E9B 2020-07-09 Pacman Keyring Master Key

sub rsa2048 2018-07-09 [E] [expires: 2023-02-03]

sig 403BD972F75D9D76 2020-02-04 ArchZFS Bot

It does appear as thought the key downloaded vs. the key grabbed for the long fingerprint are different, but I don't know what the meaning of that is.