Rebuild fails with pgp error/prompt (signature from ... is marginal trust) about archlinux-repro HOT 5 CLOSED

Total Installed Size: 3466.15 MiB
Net Upgrade Size: 240.41 MiB

:: Proceed with installation? [Y/n] y
(666/666) checking keys in keyring [########################################################################] 100%
(666/666) checking package integrity [########################################################################] 100%
error: libffi: signature from "David Runge [email protected]" is marginal trust
:: File /var/cache/pacman/pkg/libffi-3.4.4-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n] ^C
Interrupt signal received

from archlinux-repro.

@vosskaem can you share which package you're trying to rebuild? :)

from archlinux-repro.

I tried to update archlinux after about 3 years. Finally I could fix it.
Normaly I always start such big update with installing archlinux-keyrings but this alone does not the job this time.
I got a lot of "Import the following key...", later I got a message that a key has marginal trust. (the message above).
After Importing keys via gpg by hand and later installing again archlinux-keyrings, it worked.
I don't know, why it was not enough to update archlinux-keyrings first.

from archlinux-repro.

That's a similiar issue, but this repository is specifically about archlinux-repro. :) Yes, running pacman -Sy archlinux-keyring before pacman -Suy is sometimes necessary unfortunately.

from archlinux-repro.

Fixed in #122

from archlinux-repro.