185

I'm using an unsigned repo in Ubuntu 16.04 from Debian multimedia:

deb http://www.deb-multimedia.org jessie main

To install deb-multimedia-keyring, I'm running:

apt-get update && apt-get install deb-multimedia-keyring -y

This gives an error:

W: GPG error: http://www.deb-multimedia.org jessie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5C808C2B65558117
E: The repository 'http://www.deb-multimedia.org jessie InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
0

8 Answers 8

200

You can set options in your sources.list (located at /etc/apt/sources.list):

deb [trusted=yes] http://www.deb-multimedia.org jessie main

The trusted option is what turns off the GPG check. See man 5 sources.list for details.

You can either edit the file within the terminal with vim ( or whatever you prefer) or any non-terminal editor like gedit.

6
  • How do we access the sources.list from the terminal?
    – fuzzi
    Nov 20, 2018 at 15:40
  • 2
    It is located in /etc/apt/sources.list. You can either edit it within the terminal with vim ( or whatever you prefer) or any non-terminal editor like gedit. Nov 20, 2018 at 22:48
  • 1
    What does jessie main mean? I am using Lubuntu 20.04 LTS.
    – ahorn
    Dec 28, 2020 at 6:50
  • jessie is the distribution release name and main is the component name. You can find info on component names here Dec 29, 2020 at 4:21
  • 6
    my issue was with a repo added with add-apt-repository. Be sure to check /etc/apt/sources.list.d/ for any .list files that might have the source you are trying to trust, in addition to the sources in /etc/apt/sources.list
    – L Co
    Jun 25, 2021 at 20:51
112

You can bypass some important safeguards by using the following option:

--allow-unauthenticated

From the man pages for apt-get:

--allow-unauthenticated
    Ignore if packages can't be authenticated and don't prompt about
    it. This can be useful while working with local repositories, but
    is a huge security risk if data authenticity isn't ensured in
    another way by the user itself. The usage of the Trusted option for
    sources.list(5) entries should usually be preferred over this
    global override. Configuration Item:
    APT::Get::AllowUnauthenticated.

But be a little cautious about using this option more widely, the safeguards are in place to protect your computer not limit your freedom...

Edit

From newer versions of Ubuntu, instead of --allow-unauthenticated, --allow-insecure-repositories can be used.

In order to perform an update the command would be this

sudo apt-get update --allow-insecure-repositories
7
  • 1
    I use Raspbian stretch and get even with the option E: The repository 'http://ftp.de.debian.org/debian testing InRelease' is not signed. I want to upgrade from python 3.5. t 3.6.
    – Timo
    Apr 2, 2018 at 12:59
  • 3
    told me that "this option can't be interpreted together with the other options"when executing sudo apt-get update --allow-unauthenticated
    – xeruf
    May 12, 2018 at 22:45
  • 78
    NOTE: This no longer seems to work in Ubuntu 18.04 as of July 2018.
    – Jay Taylor
    Jul 9, 2018 at 2:29
  • 3
    Interesting; perhaps there might be something else different on the machine I tried it from behind the errors I observed. In any case, adding the [trusted=yes] field to sources.list did work. Thanks for your diligence @andrew.46 :)
    – Jay Taylor
    Jul 9, 2018 at 18:59
  • 50
    I had luck with --allow-insecure-repositories via this other answer.
    – kshakir
    Sep 11, 2019 at 14:35
15

Another generic solution would be

sudo apt-key adv --keyserver pgp.mit.edu --recv-keys 5C808C2B65558117

Note: I didn't test the solution with this repository but I did it with Skype repository and it worked just fine.

Another solution specific to your case is to install the keys

wget http://www.deb-multimedia.org/pool/main/d/deb-multimedia-keyring/deb-multimedia-keyring_2012.05.05_all.deb -O deb-multimedia-keyring.deb
sudo dpkg -i multimedia-keyring_all.deb

As described in the full walk through: How To Install The Debian Multimedia Repository On Debian Operating Systems

4
  • This solution worked... but I now get a warning "Key is stored in a legacy trusted.gpg keyring (.etc.apt/trusted.gpg), see the DEPRECATIONsection in apt-key for details" Aug 23, 2023 at 21:51
  • suggested change is instead of "| sudo apt-key add -" "sudo tee /etc/apt/trusted.gpg.d/myrepo.asc" Aug 23, 2023 at 21:53
  • 1
    The link is bad. Dec 16, 2023 at 18:58
  • @MartinDelille Thank you! I just replaced the link with one from archive.org
    – sotirov
    Dec 16, 2023 at 19:27
8

If you are trying to get a package from a repository where they packaged the keys and include them within the repository and no where else, it can be very annoying to download and install the key/keyring package using dpkg, and very difficult to do so in an easily scriptable and repeatable manner.

The below script is not recommended if you can install the keys from a keyserver (as recommended in another answer using apt-key adv) or if you can download them from a trusted source via https and install using apt-key (eg wget https://trusted.key.site/my-trusted-key.gpg | sudo apt-key add -), but if you don't have ANY other way, you can use this.

echo "deb http://your.repo.domain/repository/ $(lsb_release -c -s) universe" | sudo tee /etc/apt/sources.list.d/your-repo-name.list

sudo apt -o Acquire::AllowInsecureRepositories=true \
-o Acquire::AllowDowngradeToInsecureRepositories=true \
update

## if the 'apt update' above fails it is likely due to previously
## having the GPG key and repository on the system, you can clean
## out the old lists with `sudo rm /var/lib/apt/lists/your.repo.domain*`

apt-get -o APT::Get::AllowUnauthenticated=true install repo-keyring-pkgname

## If you ever run `sudo apt-key del your-repos-keyID`
## you may have to `sudo apt remove --purge repo-keyring-pkgname`
## Update should run without the GPG warnings now that the key is installed

apt-get update
apt-get install somepkg-from-repo

I originally put this together because i3 in their sur5r repo does this, but then I found out their keys are in the keyserver.ubuntu.com list, so I can just sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E3CA1A89941C42E6 and avoid all the extra package hassles.

2
  • This answer seems incomplete when faced with Ubuntu 18.04 There it tries to annoy me by saying nasty things like ... Release is not valid yet (invalid for another 44min 35s). Updates for this repository will not be applied. Even after rm-ing the /var/lib/apt/lists/* things... Apr 25, 2018 at 18:05
  • That is simply a mirror replication problem and shouldn't affect the authentication or signing of packages in the repositories. Since 1804 is just coming out of beta a lot of mirrors are trying to catch up and the mirroring service may point you to server that isn't fully in sync yet.
    – dragon788
    Apr 27, 2018 at 1:24
6

You can get the PUBLIC_KEY from the keyserver and add it into apt-key. Assuming the keyserver is pgpkeys.mit.edu, you first need to type in:

gpg --keyserver pgpkeys.mit.edu --recv-key KEY_IN_ERROR
gpg -a --export KEY_IN_ERROR | sudo apt-key add -

Replace the key KEY_IN_ERROR with the one in your error message, i.e. 5C808C2B65558117.

Also, if you are really interested in adding an unsigned repository, you can add the a flag in the desired repository entry in the sources.list like this:

deb [allow-insecure=yes] http://www.deb-multimedia.org jessie main

This is really useful if you want to fine tune your security settings for an individual entries.

2
  • adding [allow-insecure=yes] worked for me Jul 8, 2021 at 11:36
  • Worked like a charm! Thanks.
    – Jon
    Apr 21, 2023 at 22:37
6

N: See apt-secure(8) manpage for repository creation and user configuration details.

answer:

  1. ls /etc/apt/sources.list.d

next try removing them using

  1. sudo rm -i /etc/apt/sources.list.d/{output of 1}

do it for each

eg: sudo rm -i /etc/apt/sources.list.d/wireshark-dev-ubuntu-stable-focal.list

then try

  1. sudo apt update

:)

0
6

This is somewhat duplicating an existing answer but --allow-insecure-repositories and --allow-unauthenticated only worked in certain combinations. Here for example with the insecure deadsnakes repository:

sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt-get update --allow-insecure-repositories
sudo apt-get install python3.9* --allow-unauthenticated
2
  • 1
    Doesn't work on Ubuntu 20.04
    – yegor256
    Feb 27, 2022 at 15:04
  • I tried the answer on a Linux Mint that was based on Ubuntu 18.04 in case that helps anyone
    – xjcl
    Feb 27, 2022 at 15:07
2

This is kind of late to the table, but I only ran into this yesterday. Upon installing from the .iso for 18.04 LTS, obtained from ubuntu.com, I encountered this issue and also, ifconfig and other network tools were not installed. Wifi did not work.

This was on a Lenovo X140e laptop, the kind that is preloaded with Windows and given to someone who completes a computer course.

I reinstalled a few times without better results, perhaps because the definition of insanity applies. I then put 16.04 LTS on a stick and installed that. I had to fool around with BIOS settings to install. Interestingly, network apps were installed and wifi found connections. I got the same message (repository is unsigned, etc.) at first from Software Updater, but then it told me there was a new release and asked me, did I want it.

I gave it a try and now everything works in 18.04. Make of that what you will. I would like to add that none of the other answers on this page worked. That is why I contribute this "solution."

4
  • 18.04 does not use ifconfig, it uses netplan. Going from 16.04 to 18.04 will keep ifconfig and may work better for your device, but I do not see how it is related to installing from unsigned repositories.
    – Paul
    Apr 15, 2020 at 7:56
  • That is almost certainly what happened. The point is that after installing 18.04 bare, updates did not work: "repository is unsigned". To get updates to work properly I had to install 16.04 and then upgrade to 18.04.
    – Wastrel
    Apr 15, 2020 at 14:16
  • Ah okay, it's not that clear in the story above. But now on 18.04 you can still install from unsigned repositories w/o any error message? T.b.h you kind of want to get the message as it may indicate something is wrong and you can exclude specific repositories from this check with the answers above.
    – Paul
    Apr 16, 2020 at 11:04
  • Yes, it all works fine after following the upgrade procedure. It's rather puzzling that the .iso for 18.04 and 16.04 did not, in themselves, have the signatures to the standard repositories.
    – Wastrel
    Apr 23, 2020 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .