Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Yesterday when I tried to update packages, I received a message asking me if I want to install an unsigned package. I clicked no and stopped the update.

Today I updated all packages without the message.

So, what are unsigned packages and should I install them?

  • I've done a sudo apt-get update to update the package lists and I still get the error
  • I am not using any PPAs
share|improve this question

4 Answers 4

up vote 5 down vote accepted

You should NOT trust unsigned packages. From a security standpoint, a signed package means that the person who made it used a PGP key that is owned by them to say "I created this package, and I verify its authenticity!" Unsigned packages are risky because you have no idea who the developer is (while you do with signed packages).

The other issue with updating is that if you use a PPA, it may be reading packages as unsigned if the PGP keys that originally signed them are not being downloaded, in which case you should make sure that you can connect to keyservers and make sure that the signee of the package has a key in the Ubuntu keyservers.

share|improve this answer
    
That is what I thought when I clicked no. I didn't enable any PPA repository, which made me wonder why I got the message. –  BЈовић Jul 14 '11 at 6:40

If you don't have any PPAs and are just using a stock configuration and you are getting unsigned packages it could be a sign that the mirror you are pulling from is misconfigured or in the middle of updating or something.

If you see this error too often consider switching to another Ubuntu mirror:

share|improve this answer

You should add next time, the repository keys when you add one

normaly adding a PPA with add-apt-repository should do it

example

sudo add-apt-repository ppa:mozillateam/firefox-stable

adds the ppa and the key

share|improve this answer
    
I am trying to keep my system as stable as possible, therefore I am not enabling beta repositories. –  BЈовић Jul 14 '11 at 6:35

Often, you can fix errors about packages not being able to be authenticated by running sudo apt-get update to recheck the packages lists and redownload the signatures. If you are getting errors about authentication, do not be lazy and just install be packages. Instead, find out why the packages cannot be authenticated and fix that problem first. That way, a malicious person wouldn't be able to trick you into installing his possibly rootkited in place of the real thing.

share|improve this answer
    
That is what I also tried, but the package was still unsigned. –  BЈовић Jul 14 '11 at 6:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.