[Issue]: znver4 repo sync fails due to expired/unrecognized signing key

### Package name

cachyos-keyring

### Package version

20240331-1

### Issue type

Other

### Description

## Issue: znver4 repo sync fails due to expired/unrecognized signing key

### Summary
Syncing cachyos-core-znver4 and cachyos-extra-znver4 fails with "signature from
'CachyOS ' is invalid" on all up-to-date CachyOS
installations. This appears to be caused by either a key rotation that was not
accompanied by an updated cachyos-keyring package, or an expired signing subkey
that was never renewed. The main [cachyos] repo is unaffected due to its
existing SigLevel = Optional TrustAll override.

### Environment
- OS: CachyOS (Arch-based, znver4 / AMD Zen 4)
- pacman keyring: cachyos-keyring-20240331-1 (latest available in repo)
- Affected repos: cachyos-core-znver4, cachyos-extra-znver4
- Unaffected repos: cachyos, cachyos-znver4, core, extra, multilib

### Steps to reproduce
1. Run: sudo pacman -Sy
2. Observe signature errors on cachyos-core-znver4 and cachyos-extra-znver4

### Error output
error: cachyos-core-znver4: signature from "CachyOS " is invalid
error: cachyos-extra-znver4: signature from "CachyOS " is invalid
error: failed to synchronize all databases (unexpected error)

### Investigation
The DB files are signed with key 882DCFE48E2051D48E2562ABF3B607488DB35A47.
Inspecting this key reveals its encryption subkey expired on 2023-08-10:

pub rsa3072/F3B607488DB35A47 created: 2021-08-10 expires: never
sub rsa3072/9B71BE9D397982C5 created: 2021-08-10 expired: 2023-08-10

pacman/gpg rejects the signature as invalid due to the expired subkey material,
even though the key is present and locally signed in the keyring. All standard
remediation steps (pacman-key --init, --populate, --refresh-keys, reinstalling
cachyos-keyring) do not resolve the issue as they only re-import the same key.

The cachyos-keyring package (20240331-1) has not been updated in over a year.
This creates a deadlock for affected users: the DB cannot be synced to install
an updated keyring, and the existing keyring contains only the expired key.

Note: if this is an intentional key rotation, the updated cachyos-keyring
package distributing the new trusted key was not published simultaneously,
leaving users unable to sync without manual intervention.

### Workaround
Add SigLevel = Optional TrustAll to the three znver4 repo sections in
/etc/pacman.conf — matching the existing override already present on [cachyos]:

[cachyos-znver4]
SigLevel = Optional TrustAll
Include = /etc/pacman.d/cachyos-v4-mirrorlist

[cachyos-core-znver4]
SigLevel = Optional TrustAll
Include = /etc/pacman.d/cachyos-v4-mirrorlist

[cachyos-extra-znver4]
SigLevel = Optional TrustAll
Include = /etc/pacman.d/cachyos-v4-mirrorlist

### Suggested resolution
If this was an intentional key rotation:
- Publish an updated cachyos-keyring package with the new trusted key
- Announce the rotation so users can manually import the key if needed

If this was unintentional:
- Renew or rotate the signing key (unexpired subkey)
- Ship an updated cachyos-keyring package
- Re-sign the znver4 repository databases

In either case, consider aligning the default SigLevel on znver4 repos with
the existing [cachyos] repo configuration for consistency.

### References
- Signing key fingerprint: 882DCFE48E2051D48E2562ABF3B607488DB35A47
- Expired subkey: 9B71BE9D397982C5 (expired 2023-08-10)
- DB signed: 2026-05-08 at 17:10 CEST
- cachyos-keyring last updated: 2024-03-31

### Steps to reproduce

1. Have a CachyOS installation on a Zen 4 (znver4) system with
cachyos-keyring-20240331-1 installed

2. Run: sudo pacman -Sy

3. Observe signature validation failure on cachyos-core-znver4
and cachyos-extra-znver4

4. Optionally confirm the signing key subkey expiry:
sudo gpg --homedir /etc/pacman.d/gnupg \
--list-keys 882DCFE48E2051D48E2562ABF3B607488DB35A47
→ sub rsa3072/9B71BE9D397982C5 created: 2021-08-10 expired: 2023-08-10

5. Standard remediation (pacman-key --init, --populate, --refresh-keys,
reinstalling cachyos-keyring) does not resolve the issue

### Relevant logs or error output

```shell
$ sudo pacman -Sy
error: cachyos-core-znver4: signature from "CachyOS " is invalid
error: cachyos-extra-znver4: signature from "CachyOS " is invalid
:: Synchronizing package databases...
cachyos-znver4 is up to date
cachyos-core-znver4 108,6 KiB 1449 KiB/s 00:00 [----] 100%
cachyos-extra-znver4 4,2 MiB 26,5 MiB/s 00:00 [----] 100%
cachyos is up to date
core is up to date
extra is up to date
multilib is up to date
error: cachyos-core-znver4: signature from "CachyOS " is invalid
error: cachyos-extra-znver4: signature from "CachyOS " is invalid
error: failed to synchronize all databases (unexpected error)

$ sudo gpg --homedir /etc/pacman.d/gnupg \
--list-keys 882DCFE48E2051D48E2562ABF3B607488DB35A47
gpg: WARNING: unsafe permissions on homedir '/etc/pacman.d/gnupg'
pub rsa3072/F3B607488DB35A47 2021-08-10 [SC]
882DCFE48E2051D48E2562ABF3B607488DB35A47
uid [ full ] CachyOS
sub rsa3072/9B71BE9D397982C5 2021-08-10 [E] [expired: 2023-08-10]

$ gpg --homedir /etc/pacman.d/gnupg \
--verify /var/lib/pacman/sync/cachyos-core-znver4.db.sig \
/var/lib/pacman/sync/cachyos-core-znver4.db
gpg: Signature made pá 8. května 2026, 17:10:35 CEST
gpg: using RSA key 882DCFE48E2051D48E2562ABF3B607488DB35A47
gpg: Can't check signature: No public key
```

### CachyOS bug report

https://paste.cachyos.org/p/dd641ed.log

### Additional context

_No response_