<div dir="ltr">You are right, I get the same output out of pacman-key.<div><br></div><div>The reason why I didn't not get the error on my system is that I only use xml-conduit as a dependency for building [haskell-happstack] repo, and apparently the script that does that does not check signatures.</div><div><br></div><div>I noticed that the "Last modified" time on xsound is different between the file and its signature:</div><div><br></div><div> ...</div><div> haskell-xml-conduit-1.2.3.3-78-x86_64.pkg.tar.xz<span class="" style="white-space:pre"> </span>2015-04-12 19:23<span style="white-space:pre"> </span>752K<br></div><div><div> haskell-xml-conduit-1.2.3.3-78-x86_64.pkg.tar.xz.sig<span class="" style="white-space:pre"> </span>2015-04-12 18:43<span style="white-space:pre"> </span>96</div></div><div> ...</div><div><br></div><div>so probably Magnus had to reupload it for some reason and forgot to sign it.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 14, 2015 at 2:26 AM, Skottish <span dir="ltr"><<a href="mailto:skottish97215@gmail.com" target="_blank">skottish97215@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, Apr 13, 2015 at 06:37:25AM -0700, Skottish wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Mon, Apr 13, 2015 at 09:31:12AM +0100, SP wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If you do clear the cache as Nicola suggested and you still have<br>
problems, please also tell us which mirror you are using.<br>
<br>
-- <br>
SP<br>
</blockquote>
<br>
There are no haskell packages in the cache and I tried with both xsounds<br>
and your repo SP. There's something strange with that package on both of<br>
my systems.<br>
<br>
After sleeping last night, I took a fresh look at this. On that one file<br>
the finger print is a truncated version of the fingerprint of the other<br>
haskell packages that are trying to install at the same time. So I went<br>
ahead and deleted Magnus' key, ran pacman -Suy, let the key get<br>
automatically verified, and pacman again fails on that one file. This is<br>
what happens if run pacman-key againts it:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
pacman-key -v haskell-xml-conduit-1.2.3.3-<u></u>78-x86_64.pkg.tar.xz.sig<br>
</blockquote>
==> Checking haskell-xml-conduit-1.2.3.3-<u></u>78-x86_64.pkg.tar.xz.sig ...<br>
gpg: assuming signed data in 'haskell-xml-conduit-1.2.3.3-<u></u>78-x86_64.pkg.tar.xz'<br>
gpg: Signature made Sun 12 Apr 2015 11:43:13 AM PDT using DSA key ID A418C0FE<br>
gpg: BAD signature from "ArchHaskell (Magnus Therning) <<a href="mailto:magnus@therning.org" target="_blank">magnus@therning.org</a>>" [unknown]<br>
<br>
If I do the same thing agains haskell-http-conduit, I get the full<br>
output about good signature, keys, fingerprints, and all that stuff.<br>
</blockquote>
<br></span>
I removed xml-conduit from my system and rebuilt it and the few local<br>
packages that I have that needed it.<div class="HOEnZb"><div class="h5"><br>
______________________________<u></u>_________________<br>
arch-haskell mailing list<br>
<a href="mailto:arch-haskell@haskell.org" target="_blank">arch-haskell@haskell.org</a><br>
<a href="http://mail.haskell.org/cgi-bin/mailman/listinfo/arch-haskell" target="_blank">http://mail.haskell.org/cgi-<u></u>bin/mailman/listinfo/arch-<u></u>haskell</a><br>
</div></div></blockquote></div><br></div>