7

My Lucid (10.04) installation recently started warning me that the updated packages were unauthenticated. For instance, if I open Update Manager and click the "Install Updates" button, it warns me that You are about to install software that can't be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

I don't remember seeing this before. I guess it looks like I don't have the right keys to verify signatures.


Update with more information:

I get the warning for all packages, including apt and linux-image.

This is what's in my /etc/apt/sources.list (sans comments)

deb http://us.archive.ubuntu.com/ubuntu/ lucid main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid main restricted
deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates main restricted
deb http://us.archive.ubuntu.com/ubuntu/ lucid universe
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid universe
deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe
deb http://us.archive.ubuntu.com/ubuntu/ lucid multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid multiverse
deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse
deb http://us.archive.ubuntu.com/ubuntu/ lucid-security main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-security main restricted
deb http://us.archive.ubuntu.com/ubuntu/ lucid-security universe
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-security universe
deb http://us.archive.ubuntu.com/ubuntu/ lucid-security multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-security multiverse

update 2:

Whatever it was that was wrong, it is no longer wrong, so I won't be able to verify any suggested solutions.

5
  • What is listed in System > Administration > Software Sources > Other Software?
    – ændrük
    Sep 21, 2010 at 13:26
  • I updated the question with more information.
    – dkagedal
    Sep 21, 2010 at 16:09
  • What does sudo apt-key list show? It should include the Ubuntu Archive Automatic Signing Key (437D05B5). Also try doing apt-get update again (a.k.a. “Check” in Update Manager) in case this was a transient error on a the mirror. Sep 21, 2010 at 18:52
  • It includes the key. And I'm pretty sure I have updated several times. But now I did it again, and it has stopped complaining.
    – dkagedal
    Sep 23, 2010 at 8:24
  • ... which suggests a transient network or proxy error, or that the particular mirror you were hitting was having a problem. Nov 2, 2010 at 16:13

2 Answers 2

4

Sometimes when a network connection interrupts apt-get update (or the automatic daily package list refresh), the signature file will not get written, resulting in apt yelling about the lack of authentication. In most situations (assuming no improperly configured transparent caching system is between you and the Internet), a simple sudo apt-get update will resolve the problem.

2

Chances are you've added a PPA repository and haven't added the corresponding keys. The simplest way to do this is to disable all the PPAs and go through each and throw them at add-apt-repository. This will add it back to your sources but also

So if you see something like this:

deb http://ppa.launchpad.net/f-spot/f-spot-ppa/ubuntu lucid main

Run:

sudo add-apt-repository ppa:f-spot/f-spot-ppa

I think you can also throw the whole sourceline at it so this should be valid too:

sudo add-apt-repository deb http://ppa.launchpad.net/f-spot/f-spot-ppa/ubuntu lucid main

Rinse and repeat for all your non-standard software sources.

1
  • Nope, no PPA, only lucid and lucid-updates repositories. And I get this warning for core packages such as apt itself.
    – dkagedal
    Sep 21, 2010 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .