Certificate for kirigami2

After booting up Manjaro today, the update manager notified me that I needed to update the AUR package kirigami2. So I ran:
pamac update -a
However, a warning appeared:

==> Überprüfe source Dateien mit sha256sums...
kirigami2-5.116.0.tar.xz ... Erfolg
kirigami2-5.116.0.tar.xz.sig ... Übersprungen
==> Überprüfe Signaturen der Quell-Dateien mit gpg...
kirigami2-5.116.0.tar.xz ... Erfolg (WARNUNG: Die Gültigkeit des Schlüssels ist abgelaufen.)
==> WARNUNG: Beim Überprüfen der Signaturen sind Warnungen aufgetreten.
Bitte stellen Sie sicher, dass Sie ihnen wirklich vertrauen.

There are recurring concerns regarding the AUR in Arch-based distributions, and expired certificates certainly don’t help matters. It went on to say:

Automatic MOC for target KirigamiPlugin
AutoMoc: /home/mdadmin/makepkg/kirigami2/src/kirigami2-5.116.0/src/shadowedrectangle.h:276: Warning: Property decl
aration renderType is both WRITEable and CONSTANT. CONSTANT will be ignored.

Overall, the update completed successfully. Unfortunately, kirigami2 won’t launch directly, though ktouch and spectacle run without issues. Only on ktouch there is:

qCoreApp Application(0x7ffd51bec250)
qt.qml.propertyCache.append: Member enabled of the object KeyItem_QMLTYPE_58 overrides a member of the base object
. Consider renaming it or adding final or override specifier
qt.qml.propertyCache.append: Member data of the object Balloon_QMLTYPE_104 overrides a member of the base object.
Consider renaming it or adding final or override specifier
qt.qml.propertyCache.append: Member data of the object Collapsable_QMLTYPE_188 overrides a member of the base obje
ct. Consider renaming it or adding final or override specifier

and if you start spectacle:

qt.qml.propertyCache.append: Member focusPolicy of the object UndoRedoGroup_QMLTYPE_58 overrides a
member of the base object. Consider renaming it or adding final or override specifier
qt.qml.propertyCache.append: Member focusPolicy of the object ButtonGrid_QMLTYPE_61 overrides a member of the base
object. Consider renaming it or adding final or override specifier
qt.qml.propertyCache.append: Member focusPolicy of the object AnnotationOptionsToolBarContents_QMLTYPE_67 override
s a member of the base object. Consider renaming it or adding final or override specifier

[1] + done /usr/bin/spectacle

Maybe it’s possible to obtain a new certificate.

that expired key warning is the gpg key on the tarball aging out. sha256 still said Erfolg so the archive itself matched.

b4 fighting the aur build, check if manjaro already has kirigami from the repos:
-pacman -Ss kirigami
-pacman -Qi kirigami2

if the repo package covers u, skip the aur one. if u still need that aur package:
-open the PKGBUILD and grab validpgpkeys
-gpg --recv-keys THATKEY
-or build once with --skippgpcheck

the AutoMoc shadowedrectangle line is just a warning, not the install killer.

As I said, the build was successful. My only concern was if the key-chain is not valid some intruders could change the code. And recv-keys only works, if such a newer key exists.

Then there’s the package kirigami as official build while kirigami2 seemingly comes from AUR.

pacman -Qi kirigami
Name                     : kirigami
Version                  : 6.29.0-1
Beschreibung             : A QtQuick based components set
Architektur              : x86_64
URL                      : 

Lizenzen                 : LGPL-2.0-only  LGPL-3.0-only
Gruppen                  : kf6
Stellt bereit            : Nichts
Hängt ab von             : glibc  libgomp  libstdc++  qt6-base  qt6-declarative  qt6-svg
Optionale Abhängigkeiten : Nichts
Benötigt von             : aurorae  bluedevil  breeze  elisa  filelight  flatpak-kcm  kaccounts-integration
kaccounts-providers  kamoso  kcmutils  kdeconnect  kdenetwork-filesharing
kdeplasma-addons  kinfocenter  kirigami-addons  knewstuff  kquickcharts
kquickimageeditor  kscreen  kscreenlocker  ktouch  kwin  libksysguard  libplasma
milou  mimetreeparser  plasma-desktop  plasma-login-manager  plasma-nm  plasma-pa
plasma-systemmonitor  plasma-workspace  plymouth-kcm  polkit-kde-agent  powerdevil


print-manager  purpose  qqc2-breeze-style  qqc2-desktop-style  sddm-kcm  spectacle
systemsettings  xdg-desktop-portal-kde
Optional für             : ksvg
In Konflikt mit          : Nichts
Ersetzt                  : Nichts
Installationsgröße       : 6,16 MiB
Packer                   : Antonio Rojas arojas@archlinux.org
Erstellt am              : So 16 Aug 2026 14:31:34 CEST
Installiert am           : So 23 Aug 2026 21:35:56 CEST
Installationsgrund       : Ausdrücklich installiert
Installations-Skript     : Nein
Verifiziert durch        : Signatur

other than:



pacman -Qi kirigami2 
Name                     : kirigami2 
Version                  : 5.116.0-3 
Beschreibung             : A QtQuick based components set 
Architektur              : x86_64 
URL                      : 
 
Lizenzen                 : LGPL 
Gruppen                  : kf5 
Stellt bereit            : Nichts 
Hängt ab von             : qt5-quickcontrols  qt5-quickcontrols2  qt5-graphicaleffects 
Optionale Abhängigkeiten : Nichts 
Benötigt von             : Nichts 
Optional für             : Nichts 
In Konflikt mit          : Nichts 
Ersetzt                  : Nichts 
Installationsgröße       : 1846,09 KiB 
Packer                   : Unknown Packager 
Erstellt am              : Mo 28 Sep 2026 09:22:18 CEST 
Installiert am           : Mo 28 Sep 2026 09:27:51 CEST 
Installationsgrund       : Installiert als Abhängigkeit eines anderen Pakets 
Installations-Skript     : Nein 
Verifiziert durch        : Nichts

So kirigami and kirigami2 are different.

yeah u already have the real one. kirigami 6.29 from the repos is frameworks 6. kirigami2 on aur is the old kf5 leftover, so that expired key on the aur tarball doesnt matter for ur desktop.

-pamac remove kirigami2
-or just ignore that aur update

leave the repo kirigami alone.

That was what I wanted to know. With Flatpak and other environments, you often have to maintain multiple versions side by side. But after I deleted kirigami2, everything ran just as before. By that I found other packages to remove:

Entferne lib32-portaudio (1:19.7.0-3)... [1/19]
Entferne kpackage5 (5.116.0-3)... [2/19]
Entferne python-pyasn1-modules (0.4.2-2)... [3/19]
Entferne python-build (1.6.0-1)... [4/19]
Entferne linux612-vhba-module (20260313-32)... [5/19]
Entferne python-tpm2-pytss (3.0.0-1)... [6/19]
Entferne linux612-rtl8723bu (20260507-25)... [7/19]
Entferne python-pyproject-hooks (1.2.0-6)... [8/19]
Entferne python-pytest (1:9.1.0-1)... [9/19]
Entferne python-asn1crypto (1.5.1-6)... [10/19]
Entferne python-installer (1.0.1-1)... [11/19]
Entferne linux612-r8168 (8.056.02-37)... [12/19]
Entferne python-iniconfig (2.3.0-1)... [13/19]
Entferne kirigami2 (5.116.0-3)... [14/19]
Entferne qt5-graphicaleffects (5.15.19-1)... [15/19]
Entferne qt5-quickcontrols2 (5.15.19+kde+r5-1)... [16/19]
Entferne qt5-quickcontrols (5.15.19-1)... [17/19]
Entferne python-pyasn1 (0.6.4-1)... [18/19]
Entferne extra-cmake-modules (6.29.0-1)... [19/19]
Starte Post-Transaction-Hooks...