Developer key not trusted is signing core packages

[nicowilliams]

Describe the issue

Trying to make Appveyor w/ msys2 build Heimdal I keep running into walls like:

bash -lc "pacman --noconfirm --sync --refresh --refresh --sysupgrade --sysupgrade || echo wtf"
:: Synchronizing package databases...
downloading mingw32.db...
downloading mingw32.db.sig...
error: mingw32: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" is unknown
error: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" could not be looked up remotely
error: failed to update mingw32 (invalid or corrupted database (PGP signature))
downloading mingw64.db...
downloading mingw64.db.sig...
error: mingw64: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" is unknown
error: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" could not be looked up remotely
error: failed to update mingw64 (invalid or corrupted database (PGP signature))
downloading msys.db...
downloading msys.db.sig...
error: msys: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" is unknown
error: key "5F944B027F7FE2091985AA2EFA11531AA0AA7F57" could not be looked up remotely
error: failed to update msys (invalid or corrupted database (PGP signature))
error: failed to synchronize all databases
wtf

I... know what that key is. Apparently it's an msys2 developer's key. I don't understand why that key is being used to sign packages in the msys2 repo when that key is not in the trusted key list for msys2. I also don't know how to add it -- I would add it, if I knew how to.

You can see my fork of Heimdal's appveyor.yml file (where I'm just banging on the keyboard at this point) and then look at a build log from appveyor (build: https://ci.appveyor.com/project/nicowilliams/heimdal/builds/42075413).

Steps to Reproduce the Problem

1. Make a github repository.
2. Setup appveyor for it.
3. Attempt to install things like autoconf, automake, bison, etc.
4. Observe failures like the one listed above or shown in the appveyor log linked above.

Additional Context: Operating System, Screenshots

Screenshot attached. Appveyor build and build log linked.

• OS: Whatever Appveyor CI is giving me

[nicowilliams]

Really, I've no idea what to do here. Clue me in. Pretend I'm 5. I've found tons of pages, none too useful.

[Biswa96]

Random workaround. Try to use latest Windows image in Appveyor e.g. Visual Studio 2022 or Visual Studio 2019. More here https://www.appveyor.com/docs/build-environment/. Also I would suggest to use GitHub Actions instead.

[lazka]

I've added a note to the CI guide: msys2/msys2.github.io@5fc9d54 -> https://www.msys2.org/docs/ci/#appveyor

[nicowilliams]

Yes, github actions might be the way to go.

[nicowilliams]

Thanks! I'll close this issue by end of day hopefully.

[nicowilliams]

Ok! I got past pacman package installation. Now onto other appveyor issues.

Thanks so much!

[davidadafia]

This error put my head in a spin. Eventually I ended up uninstalling ruby installer and downloaded the latest version with the devkit. Updated and good to go. Hope this helps.