Pakfire refresh problem

jorldomi · 11 September 2026 16:13

Dear Support Team:

I have the following problem: when I try to update the system status in the Pakfire configuration by pressing “Refresh List”, the following screen appears:

Sep 11 11:46:25 ipfire pakfire: PAKFIRE INFO: IPFire Pakfire 2.29-x86_64 started!
Sep 11 11:46:25 ipfire pakfire: MIRROR INFO: server-list.db is 1031673 seconds old. - DEBUG: force
Sep 11 11:46:25 ipfire pakfire: DOWNLOAD STARTED: 2.29-x86_64/lists/server-list.db
Sep 11 11:46:25 ipfire pakfire: DOWNLOAD INFO: Host: pakfire.ipfire.org (HTTPS) - File: 2.29-x86_64/lists/server-list.db
Sep 11 11:46:26 ipfire pakfire: DOWNLOAD INFO: 2.29-x86_64/lists/server-list.db has size of 2040 bytes
Sep 11 11:46:27 ipfire pakfire: DOWNLOAD INFO: HTTP-Status-Code: 200 - 200 OK
Sep 11 11:46:27 ipfire pakfire: DOWNLOAD INFO: File received. Start checking signature…
Sep 11 11:46:27 ipfire pakfire: DOWNLOAD ERROR: The downloaded file (2.29-x86_64/lists/server-list.db) wasn’t verified by IPFire.org. Sorry - Exiting…
Sep 11 11:46:28 ipfire pakfire: TIME INFO: Time Server 200.89.75.197 has +0.007891 sec offset to localtime.
Sep 11 11:46:28 ipfire pakfire: PAKFIRE INFO: Pakfire has finished. Closing.

My IPFire version is IPFire 2.29 (x86_64) - Core-Update 203, and I am using Google’s DNS servers.

How can I resolve this issue?

Thank you very much in advance.

Best regards.

bonnietwin · 11 September 2026 16:25

Try different DNS servers to the Google ones. It looks like Google does something with their DNSSEC settings which the knot-resolver DNS server in IPFire does not like.

There will probably be some messages about the google servers in the DNS logs.

Simplest will be to disable the google servers on the dns page and enter some other ones and then try again.

Due to a potential bug in the dns.cgi page you might need to press the Save button in the lower section of the dns.cgi page as well as the Save button in the upper section.

jorldomi · 11 September 2026 17:01

Dear Adolf :

Thank you for the prompt response. I disabled Google DNS and enabled Cloudflare following your instructions but the problem persists. attached screenshot.

Thank you very much.

Best Regards.

pscar13 · 11 September 2026 17:21

see

jorldomi · 11 September 2026 17:39

Dear pscar13 :

Thanks for sharing your solution, but unfortunately it doesn’t work for me.

Best regards.

jorldomi · 11 September 2026 17:42

after try pscar13 solution show the following :

[root@ipfire ~]# gpgconf --homedir /opt/pakfire/etc/.gnupg --kill all
[root@ipfire ~]# pakfire update --force
server-list.db 100.00% |=============================>| 2.04 KB
DOWNLOAD ERROR: The downloaded file (2.29-x86_64/lists/server-list.db) wasn’t verified by IPFire.org. Sorry - Exiting…
TIME INFO: Time Server 200.89.75.197 has -0.068442 sec offset to localtime.

Best regards

hjkl · 11 September 2026 17:54

Hello Jorge,
Please try this

#Import pakfire keys
 gpg --import /opt/pakfire/pakfire-2018.key /opt/pakfire/pakfire-2022.key

# Check the pakfire keys
 gpg --list-keys pakfire@ipfire.org

Expected result:

pub   rsa4096 2018-03-16 [SC]
      3ECA8AA4478208B924BB96206FEF7A8ED713594B
uid           [ unknown] IPFire Pakfire Package Signing Key <pakfire@ipfire.org>

pub   rsa4096 2022-03-21 [SC]
      98448779295007D302A91E32A551AE95C8DCE211
uid           [ unknown] IPFire Pakfire Package Signing Key <pakfire@ipfire.org>
sub   rsa4096 2022-03-21 [E]

pscar13 · 11 September 2026 17:59

Another solution here

cd /opt/pakfire/etc/.gnupg
rm -f trustdb.gpg
/etc/rc.d/init.d/pakfire start
gpg --import /opt/pakfire/pakfire-2018.key /opt/pakfire/pakfire-2022.key
pakfire update --force

jorldomi · 12 September 2026 13:09

Dears :

after running all the suggested commands unfortunately the problem persist.

I’m sharing the commands I ran and the results obtained.

[root@ipfire etc]# cd /opt/pakfire/etc/.gnupg

[root@ipfire .gnupg]# ls -lt
total 20
-rw------- 1 root root 600 Sep 11 23:19 random_seed
drwxr-x— 2 root root 4096 Sep 11 23:19 public-keys.d
srwx------ 1 root root 0 Sep 11 14:34 S.keyboxd
drwx------ 2 root root 4096 May 30 09:03 private-keys-v1.d
-rw------- 1 root root 1200 May 30 09:03 trustdb.gpg
-rw-r----- 1 root root 12 May 30 09:03 common.conf

[root@ipfire .gnupg]# rm -f trust.gpg

[root@ipfire .gnupg]# /etc/rc.d/init.d/pakfire start
Setting up Pakfire Package Manager… [ FAIL ]
[root@ipfire .gnupg]# gpg --import /opt/pakfire/pakfire-2018.key /opt/pakfire/pakfire-2022.key
gpg: key 6FEF7A8ED713594B: public key “IPFire Pakfire Package Signing Key pakfire@ipfire.org” imported
gpg: key A551AE95C8DCE211: public key “IPFire Pakfire Package Signing Key pakfire@ipfire.org” imported
gpg: Total number processed: 2
gpg: imported: 2

[root@ipfire .gnupg]# gpg --list-keys

[keyboxd]

pub rsa4096 2018-03-16 [SC]
3ECA8AA4478208B924BB96206FEF7A8ED713594B
uid [ unknown] IPFire Pakfire Package Signing Key pakfire@ipfire.org

pub rsa4096 2022-03-21 [SC]
98448779295007D302A91E32A551AE95C8DCE211
uid [ unknown] IPFire Pakfire Package Signing Key pakfire@ipfire.org
sub rsa4096 2022-03-21 [E]
F00D0D2D6BD195E21C9DC38FE22B03D224695A3E

[root@ipfire .gnupg]# pakfire update --force
server-list.db 100.00% |=============================>| 1.93 KB
DOWNLOAD ERROR: The downloaded file (2.29-x86_64/lists/server-list.db) wasn’t verified by IPFire.org. Sorry - Exiting…
TIME INFO: Time Server 200.25.72.82 has +0.065156 sec offset to localtime.

Thanks again and best regards.

pscar13 · 12 September 2026 14:33

it was rm -f trustdb.gpg

jorldomi · 12 September 2026 15:06

Dear pscar13 :

I’m sorry, it was my mistake, I fixed it but the problem persists :

[root@ipfire ~]# cd /opt/pakfire/etc/.gnupg

[root@ipfire .gnupg]# ls -lt
total 20
-rw------- 1 root root 600 Sep 12 09:49 random_seed
drwxr-x— 2 root root 4096 Sep 12 09:49 public-keys.d
srwx------ 1 root root 0 Sep 11 14:34 S.keyboxd
drwx------ 2 root root 4096 May 30 09:03 private-keys-v1.d
-rw------- 1 root root 1200 May 30 09:03 trustdb.gpg
-rw-r----- 1 root root 12 May 30 09:03 common.conf

[root@ipfire .gnupg]# rm -f trustdb.gpg

[root@ipfire .gnupg]# ls -lt
total 16
-rw------- 1 root root 600 Sep 12 09:49 random_seed
drwxr-x— 2 root root 4096 Sep 12 09:49 public-keys.d
srwx------ 1 root root 0 Sep 11 14:34 S.keyboxd
drwx------ 2 root root 4096 May 30 09:03 private-keys-v1.d
-rw-r----- 1 root root 12 May 30 09:03 common.conf

[root@ipfire .gnupg]# /etc/rc.d/init.d/pakfire start
Setting up Pakfire Package Manager… [ FAIL ]

[root@ipfire .gnupg]# gpg --import /opt/pakfire/pakfire-2018.key /opt/pakfire/pakfire-2022.key
gpg: key 6FEF7A8ED713594B: “IPFire Pakfire Package Signing Key pakfire@ipfire.org” not changed
gpg: key A551AE95C8DCE211: “IPFire Pakfire Package Signing Key pakfire@ipfire.org” not changed
gpg: Total number processed: 2
gpg: unchanged: 2

[root@ipfire .gnupg]# pakfire update --force
server-list.db 100.00% |=============================>| 1.88 KB
DOWNLOAD ERROR: The downloaded file (2.29-x86_64/lists/server-list.db) wasn’t verified by IPFire.org. Sorry - Exiting…
TIME INFO: Time Server 200.89.75.197 has +0.008507 sec offset to localtime.

when execute /etc/rc.d/init.d/pakfire start why the pakfire service fail ?

Thanks you very much.

Regards.

pscar13 · 12 September 2026 16:42

try this

export GNUPGHOME="/opt/pakfire/etc/.gnupg"
gpg -v --import /opt/pakfire/pakfire-2018.key /opt/pakfire/pakfire-2022.key
echo $?

pscar13 · 12 September 2026 17:07

Last resort solution

Mount IPFire CU203 USB stick.
Go to Services → ExtraHD.

Mount the 669 MB partition to /mnt/img by clicking the pencil icon.

Then, from the console:

mkdir /tmp/extract
zstd -dc /mnt/img/distro.img | tar -xf - -C /tmp/extract opt/pakfire

Check the extracted directory:

ls -al /tmp/extract/opt/pakfire

You should get something similar to:

[root@ipfireTest ~]# ls -al /tmp/extract/opt/pakfire
total 48
drwxr-xr-x 6 root root  4096 May 28 16:14 .
drwxr-xr-x 3 root root  4096 Sep 12 18:55 ..
lrwxrwxrwx 1 root root    23 May 28 15:02 cache -> ../../var/cache/pakfire
drwxr-xr-x 7 root root  4096 May 28 16:14 db
drwxr-xr-x 2 root root  4096 May 28 16:14 etc
drwxr-xr-x 2 root root  4096 May 28 16:14 lib
lrwxrwxrwx 1 root root    21 May 28 15:02 logs -> ../../var/log/pakfire
-rwxr-xr-x 1 root root 15270 May 28 15:02 pakfire
-rw-r--r-- 1 root root  1648 May 28 15:02 pakfire-2018.key
-rw-r--r-- 1 root root  3163 May 28 15:02 pakfire-2022.key
drwxr-xr-x 2 root root  4096 May 28 15:02 tmp

Then replace the /opt/pakfire directory:

mv /opt/pakfire /opt/pakfire.old
cp -pr /tmp/extract/opt/pakfire /opt/pakfire

And finaly

/etc/rc.d/init.d/pakfire start
pakfire update --force

jorldomi · 13 September 2026 15:42

Dear pscar13:

The solution you proposed as a last resort worked perfectly. I’ve attached the log of the pakfire.cgi refresh list.

IPFire diagnostics
Section: pakfire
Date: September 13, 2026

12:19:01 pakfire: PAKFIRE INFO: Pakfire has finished. Closing.
12:19:01 pakfire: DOWNLOAD FINISHED: pub/linux/ipfire/pakfire2/2.29-x86_64/lists/core-list.db
12:19:01 pakfire: DOWNLOAD INFO: Signature of core-list.db is fine.
12:19:01 pakfire: DOWNLOAD INFO: File received. Start checking signature…
12:19:01 pakfire: DOWNLOAD INFO: HTTP-Status-Code: 200 - 200 OK
12:19:00 pakfire: DOWNLOAD INFO: pub/linux/ipfire/pakfire2/2.29-x86_64/lists/core-list.db has size of 903 bytes
12:18:57 pakfire: DOWNLOAD INFO: Host: ftp.gwdg.de (HTTPS) - File: pub/linux/ipfire/pakfire2/2.29-x86_64/lists/core-list.db
12:18:57 pakfire: MIRROR INFO: 19 servers found in list
12:18:57 pakfire: DOWNLOAD STARTED: lists/core-list.db
12:18:57 pakfire: CORE INFO: core-list.db is 25 seconds old. - DEBUG: force
12:18:57 pakfire: DOWNLOAD FINISHED: mirror/ipfire.org/pakfire2/2.29-x86_64/lists/packages_list.db
12:18:57 pakfire: DOWNLOAD INFO: Signature of packages_list.db is fine.
12:18:57 pakfire: DOWNLOAD INFO: File received. Start checking signature…
12:18:57 pakfire: DOWNLOAD INFO: HTTP-Status-Code: 200 - 200 OK
12:18:56 pakfire: DOWNLOAD INFO: mirror/ipfire.org/pakfire2/2.29-x86_64/lists/packages_list.db has size of 4919 bytes
12:18:55 pakfire: DOWNLOAD INFO: Host: mirror.accum.se (HTTPS) - File: mirror/ipfire.org/pakfire2/2.29-x86_64/lists/packages_list.db
12:18:55 pakfire: MIRROR INFO: 19 servers found in list
12:18:55 pakfire: DOWNLOAD STARTED: lists/packages_list.db
12:18:55 pakfire: DB INFO: packages_list.db is 28 seconds old. - DEBUG: force
12:18:55 pakfire: DOWNLOAD FINISHED: 2.29-x86_64/lists/server-list.db
12:18:55 pakfire: DOWNLOAD INFO: Signature of server-list.db is fine.
12:18:55 pakfire: DOWNLOAD INFO: File received. Start checking signature…
12:18:55 pakfire: DOWNLOAD INFO: HTTP-Status-Code: 200 - 200 OK
12:18:54 pakfire: DOWNLOAD INFO: 2.29-x86_64/lists/server-list.db has size of 1977 bytes
12:18:52 pakfire: DOWNLOAD INFO: Host: pakfire.ipfire.org (HTTPS) - File: 2.29-x86_64/lists/server-list.db
12:18:52 pakfire: DOWNLOAD STARTED: 2.29-x86_64/lists/server-list.db
12:18:52 pakfire: MIRROR INFO: server-list.db is 29 seconds old. - DEBUG: force
12:18:52 pakfire: PAKFIRE INFO: IPFire Pakfire 2.29-x86_64 started!

My question now is what caused this problem, since I haven’t modified anything in the ipfire configuration a time ago.
Thank you very much for your support; without it, I wouldn’t have been able to solve it.
Best regards.

pscar13 · 13 September 2026 15:52

It’s difficult to analyse without knowing your system and the history of your installations and upgrades.

But I’m glad that procedure worked for you

You can mark it as the “solution”; it might be useful to others.

pscar13 · 13 September 2026 16:01

Sorry, wrong topic.