Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Lucid (10.04) installation recently started warning me that the updated packages were unauthenticated. For instance, if I open Update Manager and click the "Install Updates" button, it warns me that You are about to install software that can't be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

I don't remember seeing this before. I guess it looks like I don't have the right keys to verify signatures.

Update with more information:

I get the warning for all packages, including apt and linux-image.

This is what's in my /etc/apt/sources.list (sans comments)

deb lucid main restricted
deb-src lucid main restricted
deb lucid-updates main restricted
deb-src lucid-updates main restricted
deb lucid universe
deb-src lucid universe
deb lucid-updates universe
deb-src lucid-updates universe
deb lucid multiverse
deb-src lucid multiverse
deb lucid-updates multiverse
deb-src lucid-updates multiverse
deb lucid-security main restricted
deb-src lucid-security main restricted
deb lucid-security universe
deb-src lucid-security universe
deb lucid-security multiverse
deb-src lucid-security multiverse

update 2:

Whatever it was that was wrong, it is no longer wrong, so I won't be able to verify any suggested solutions.

share|improve this question
What is listed in System > Administration > Software Sources > Other Software? – ændrük Sep 21 '10 at 13:26
I updated the question with more information. – dkagedal Sep 21 '10 at 16:09
What does sudo apt-key list show? It should include the Ubuntu Archive Automatic Signing Key (437D05B5). Also try doing apt-get update again (a.k.a. “Check” in Update Manager) in case this was a transient error on a the mirror. – Gilles Sep 21 '10 at 18:52
It includes the key. And I'm pretty sure I have updated several times. But now I did it again, and it has stopped complaining. – dkagedal Sep 23 '10 at 8:24
... which suggests a transient network or proxy error, or that the particular mirror you were hitting was having a problem. – Steve Beattie Nov 2 '10 at 16:13

Sometimes when a network connection interrupts apt-get update (or the automatic daily package list refresh), the signature file will not get written, resulting in apt yelling about the lack of authentication. In most situations (assuming no improperly configured transparent caching system is between you and the Internet), a simple sudo apt-get update will resolve the problem.

share|improve this answer

Chances are you've added a PPA repository and haven't added the corresponding keys. The simplest way to do this is to disable all the PPAs and go through each and throw them at add-apt-repository. This will add it back to your sources but also

So if you see something like this:

deb lucid main


sudo add-apt-repository ppa:f-spot/f-spot-ppa

I think you can also throw the whole sourceline at it so this should be valid too:

sudo add-apt-repository deb lucid main

Rinse and repeat for all your non-standard software sources.

share|improve this answer
Nope, no PPA, only lucid and lucid-updates repositories. And I get this warning for core packages such as apt itself. – dkagedal Sep 21 '10 at 16:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.