I'm experiencing a problem with apt. We're using our own repository and the users apt is configured to check the peer and host of the repository. Furthermore the Release file is verified (with the matching gpg key from apt-key).
So, for testing I'm trying the following scenario:
- Sign the Release files with an untrusted key
- Restart repository
When user trys to update the following warning will appear during an upgrade:
WARNING: The following packages cannot be authenticated! <list of unauthenticated package names>This is as expected so far...
Sign the Release files with a trusted key
- Restart repository
- Now the update should work. However I am still getting the warning from step 3
Note: If I run only steps 4-6 on a fresh system everything works fine.
Background information: I'm on ubuntu 10.04 with apt-0.7.25.3ubuntu9.9
I found out that sometimes if apt-get update is run and the Release file changed (because of other checksums), it's appended to the local Release file in /var/lib/apt/lists or /var/lib/apt/lists/partial (I wasn't able to reproduce this correctly). As a result of this I basically have two Release files in one. Ergo the GPG verify will fail, since it expects only one real Release file.
So why does apt not clean up old Release files before an update? - Is this a bug (since the Release.gpg file is replaced correctly and not appended)? - Or should there always be all versions of Release files in my single Release file in my repository (I doubt that)?
EDIT: If I delete the local Release, Package etc. files from /var/lib/apt/lists and /var/lib/apt/lists/partial before running step 6, everything works fine.
