Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm experiencing a problem with apt. We're using our own repository and the users apt is configured to check the peer and host of the repository. Furthermore the Release file is verified (with the matching gpg key from apt-key).

So, for testing I'm trying the following scenario:

  1. Sign the Release files with an untrusted key
  2. Restart repository
  3. When user trys to update the following warning will appear during an upgrade:

    WARNING: The following packages cannot be authenticated! <list of unauthenticated package names>

    This is as expected so far...

  4. Sign the Release files with a trusted key

  5. Restart repository
  6. Now the update should work. However I am still getting the warning from step 3

Note: If I run only steps 4-6 on a fresh system everything works fine.

Background information: I'm on ubuntu 10.04 with apt-0.7.25.3ubuntu9.9

I found out that sometimes if apt-get update is run and the Release file changed (because of other checksums), it's appended to the local Release file in /var/lib/apt/lists or /var/lib/apt/lists/partial (I wasn't able to reproduce this correctly). As a result of this I basically have two Release files in one. Ergo the GPG verify will fail, since it expects only one real Release file.

So why does apt not clean up old Release files before an update? - Is this a bug (since the Release.gpg file is replaced correctly and not appended)? - Or should there always be all versions of Release files in my single Release file in my repository (I doubt that)?

EDIT: If I delete the local Release, Package etc. files from /var/lib/apt/lists and /var/lib/apt/lists/partial before running step 6, everything works fine.

share|improve this question
    
Please add your resolution as an answer and accept it. –  Javier Rivera Mar 14 '12 at 16:37
    
@JavierRivera I don't see this as a solution, more like a workaround. This just proves my point that maybe APT has a problem handling local Release files. I would like to keep the question "open". –  timbooo Mar 14 '12 at 16:42
    
This is not a bug tracker, keeping the answer open will not help you in any way. But it could make it more difficult for people who has a similar problem to find the workaround, as now it is buried as an edit in the last line of the question. You should post your workaround as an answer and open a bug. –  Javier Rivera Mar 15 '12 at 7:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.