package/ci: yet another workaround for MSYS signatures.

package/ci/appveyor-lcov.sh

@@ -1,9 +1,15 @@
 #!/bin/bash
 set -ev
 
-# Since 2020-07-04 this is asking for Import PGP key bla? [Y/n]
+# https://www.msys2.org/news/#2020-06-29-new-packagers
-pacman -Sy --noconfirm msys2-keyring
+# TODO: drop this once AppVeyor updates the images
-pacman -S --noconfirm mingw-w64-x86_64-perl
+curl -O http://repo.msys2.org/msys/x86_64/msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz
+curl -O http://repo.msys2.org/msys/x86_64/msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz.sig
+# The instructions say {.sig,} at the end, which is apparently wrong
+pacman-key --verify msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz.sig
+pacman -U --noconfirm msys2-keyring-r21.b39fb11-1-any.pkg.tar.xz
+
+pacman -Sy --noconfirm mingw-w64-x86_64-perl
 
 # mingw lcov package is empty, so download and use it manually
 # https://github.com/appveyor/ci/issues/1628