Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I upgraded an 11.10 box to 12.04 yesterday. This morning I tried to run an apt-get upgrade and encountered the following:

sudo apt-get upgrade
[sudo] password for brian: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages have been kept back:
  linux-generic linux-headers-generic linux-image-generic
The following packages will be upgraded:
  apport apport-gtk firefox firefox-globalmenu firefox-gnome-support firefox-locale-en linux-libc-dev python-apport python-problem-report unity-scope-musicstores
10 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.
Need to get 20.1 MB of archives.
After this operation, 594 kB of additional disk space will be used.
Do you want to continue [Y/n]? 
WARNING: The following packages cannot be authenticated!
  python-problem-report python-apport apport apport-gtk linux-libc-dev unity-scope-musicstores

Any help is greatly appreciated. Thanks!

share|improve this question
Did you run sudo apt-get update just before you ran upgrade? It might be a flaw in the repo for a second. Also check and post your /etc/apt/sources.list or try to change the Ubuntu mirror selected. – gertvdijk Sep 11 '12 at 23:11

At gertvdijk mentioned above in the comment, running:

sudo apt-get update 

before running

sudo apt-get upgrade

will fix this, if you haven't run "update" recently.

So the next question for me was, "what does the 'apt-get update' command do, and why would it matter to run it before an upgrade?" After all, the system seems to know that updates are available, so what gives?

I noticed that the first few things that were downloaded by update were 'Release.gpg' files, and googling for that filename I found this:

which states about the "WARNING: The following packages cannot be authenticated!" error, "This means that the archive has begun to be signed by a new key, which your system does not know about."

Additionally, the apt-get manpage says:

update is used to resynchronize the package index files 
from their sources. The indexes of available packages are fetched 
from the location(s) specified in /etc/apt/sources.list. For 
example, when using a Debian archive, this command retrieves 
and scans the Packages.gz files, so that information about new 
and updated packages is available. An update should always be 
performed before an upgrade or dist-upgrade.

Note the last sentence there. I had totally forgotten about that.

So it seems this warning simply indicates that the package index files are out of date, because the update information includes security information that helps you know that the upgrades you are downloading are, in fact, upgrades, and not horrible trojan horses that will turn your system into a spamming botnet zombie.

You can read the SecureApt page for details about how the packages are securely signed, and the chain of trust.

This all makes sense then, but now the question becomes, "what is apt-get upgrade seeing when it tries to do an upgrade with an outdated package list? How does it know there are newer versions if the package list isn't current?"

... (out of steam for research for now!)

share|improve this answer

I believe this can happen if you have added repositories to your sources.list. Nevertheless, here are two threads you'll find helpful:

ubuntu forums thread re: the same error message

proposed fix for your problem

share|improve this answer
Following is the proposed fix from ubuntu forums sudo apt-get remove debian-keyring debian-archive-keyring sudo apt-get clean sudo apt-get update sudo apt-get -y install debian-keyring debian-archive-keyring – Pankaj Jul 22 '13 at 5:19
@Pankay Worked for me. debian-keyring was gone, must have been uninstalled by accident. – cmc Nov 16 '14 at 21:00

This can happen if you have a DNS issue or other potential networking issues that may block the traffic when running an update. It is possible that the requests may appear to succeed when running apt-get update and then only appear when apt-get upgrade has issues.

I found that my transparent HTTP proxy was blocking some of the requests and had to modify that proxy to permit the traffic. Details are in bug 574886.

After fixing my network issues, simply running apt-get update cleaned up and apt-get upgrade ran as expected.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.