4

Yesterday when I tried to update packages, I received a message asking me if I want to install an unsigned package. I clicked no and stopped the update.

Today I updated all packages without the message.

So, what are unsigned packages and should I install them?

  • I've done a sudo apt-get update to update the package lists and I still get the error
  • I am not using any PPAs

4 Answers 4

5

You should NOT trust unsigned packages. From a security standpoint, a signed package means that the person who made it used a PGP key that is owned by them to say "I created this package, and I verify its authenticity!" Unsigned packages are risky because you have no idea who the developer is (while you do with signed packages).

The other issue with updating is that if you use a PPA, it may be reading packages as unsigned if the PGP keys that originally signed them are not being downloaded, in which case you should make sure that you can connect to keyservers and make sure that the signee of the package has a key in the Ubuntu keyservers.

1
  • That is what I thought when I clicked no. I didn't enable any PPA repository, which made me wonder why I got the message. Jul 14, 2011 at 6:40
2

If you don't have any PPAs and are just using a stock configuration and you are getting unsigned packages it could be a sign that the mirror you are pulling from is misconfigured or in the middle of updating or something.

If you see this error too often consider switching to another Ubuntu mirror:

1

Often, you can fix errors about packages not being able to be authenticated by running sudo apt-get update to recheck the packages lists and redownload the signatures. If you are getting errors about authentication, do not be lazy and just install be packages. Instead, find out why the packages cannot be authenticated and fix that problem first. That way, a malicious person wouldn't be able to trick you into installing his possibly rootkited in place of the real thing.

1
  • That is what I also tried, but the package was still unsigned. Jul 14, 2011 at 6:36
0

You should add next time, the repository keys when you add one

normaly adding a PPA with add-apt-repository should do it

example

sudo add-apt-repository ppa:mozillateam/firefox-stable

adds the ppa and the key

1
  • I am trying to keep my system as stable as possible, therefore I am not enabling beta repositories. Jul 14, 2011 at 6:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .