WARNING: The following packages cannot be authenticated!

hack3rcon · 11-12-2018, 04:31 AM

Hello.
I'm using "Debian 8.11" and when I want to update my system, then I got the following message:

Code:

WARNING: The following packages cannot be authenticated!
  libgnutls-openssl27 libgnutls-deb0-28:i386 libgnutls-deb0-28 libtiff5:i386
  libtiff5 libmagickwand-6.q16-2 libmagickcore-6.q16-2 imagemagick-common
  libcurl3 libcurl3-gnutls mysql-common libmysqlclient18 libpoppler46
  libpoppler-glib8 tzdata-java tzdata firefox-esr iceweasel imagemagick
  imagemagick-6.q16 libmagickcore-6.q16-2-extra poppler-utils
Install these packages without verification? [y/N]

Is it OK?

Thank you.

berndbausch · 11-12-2018, 05:42 AM

Plenty of results when you search for this warning. Which result fits your situation, only you can find out.

It says that your package manager is unable to verify the packages' signatures. You may have the wrong key on your system. It's probably benign, except that you can't be certain that the packages are legitimate.

hack3rcon · 11-13-2018, 12:14 AM

Quote:

Originally Posted by berndbausch

Plenty of results when you search for this warning. Which result fits your situation, only you can find out.

It says that your package manager is unable to verify the packages' signatures. You may have the wrong key on your system. It's probably benign, except that you can't be certain that the packages are legitimate.

How can I check my key? How can I sure?

berndbausch · 11-13-2018, 12:42 AM

Please educate yourself about apt key management, or read the documents found by google. For example https://askubuntu.com/questions/7556...ntu-repository, whereyou find one comment

Quote:

sudo apt-get update
Was enough to fix it for me.

hack3rcon · 11-20-2018, 01:00 AM

Quote:

Originally Posted by berndbausch

Please educate yourself about apt key management, or read the documents found by google. For example https://askubuntu.com/questions/7556...ntu-repository, whereyou find one comment

I did:

Code:

$ sudo apt-key update
gpg: key 65FFB764: "Wheezy Stable Release Key <debian-release@lists.debian.org>" not changed
gpg: key 46925553: "Debian Archive Automatic Signing Key (7.0/wheezy) <ftpmaster@debian.org>" not changed
gpg: key 518E17E1: "Jessie Stable Release Key <debian-release@lists.debian.org>" not changed
gpg: key 2B90D010: "Debian Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>" not changed
gpg: key C857C906: "Debian Security Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>" not changed
gpg: key 1A7B6500: "Debian Stable Release Key (9/stretch) <debian-release@lists.debian.org>" not changed
gpg: key F66AEC98: "Debian Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>" not changed
gpg: key 8AE22BA9: "Debian Security Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>" not changed
gpg: Total number processed: 8
gpg:              unchanged: 8

But I got same error when I did "apt-get update"!!!

berndbausch · 11-20-2018, 02:23 AM

Quote:

Originally Posted by hack3rcon

But I got same error when I did "apt-get update"!!!

The key update command outputs “not changed”. So you still use the old key, or your problem is somewhere else.

EDIT: You may be missing the keys for the abovementioned packages. It’s not clear to me how to get them though. You can list installed keys with apt-key list.

EDIT2: Perhaps this document helps: https://wiki.debian.org/SecureApt.
With that, enough googling for today.

EDIT3: One more. An interesting quote from the SecureApt document:

Quote:

The debian-archive-keyring package is used to distribute keys to apt. Upgrades to this package can add (or remove) gpg keys for the main Debian archive.

hydrurga · 11-20-2018, 11:55 AM

Can you paste the output from the following command so that I can have a look at your software sources. Many thanks.

Code:

for i in /etc/apt/sources.list{,.d/*}; do echo file: $i; cat $i; echo ====; done

hack3rcon · 11-28-2018, 05:30 AM

Quote:

Originally Posted by hydrurga

Can you paste the output from the following command so that I can have a look at your software sources. Many thanks.

Code:

for i in /etc/apt/sources.list{,.d/*}; do echo file: $i; cat $i; echo ====; done

The output is:

Code:

deb http://security.debian.org/ jessie/updates main contrib 
deb-src http://security.debian.org/ jessie/updates main contrib 

# jessie-updates, previously known as 'volatile'
# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.

deb http://ftp.debian.org/debian/ jessie-updates contrib main 
deb-src http://ftp.debian.org/debian/ jessie-updates contrib main 

##############################

# deb http://httpredir.debian.org/debian/ jessie main 
# deb-src http://httpredir.debian.org/debian/ jessie main 

# deb http://httpredir.debian.org/debian/ jessie-updates main 
# deb-src http://httpredir.debian.org/debian/ jessie-updates main 


################################

deb http://httpredir.debian.org/debian/ jessie main contrib non-free 
deb-src http://httpredir.debian.org/debian/ jessie main contrib non-free 

deb http://httpredir.debian.org/debian/ jessie-updates main contrib non-free 
deb-src http://httpredir.debian.org/debian/ jessie-updates main contrib non-free 

##################################

deb http://ftp.debian.org/debian jessie-backports main

##################################

deb http://ftp.de.debian.org/debian jessie main

====
file: /etc/apt/sources.list.d/google-chrome.list
###
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
# deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main  

====
file: /etc/apt/sources.list.d/jitsi-stable.list
deb https://download.jitsi.org stable/
====
file: /etc/apt/sources.list.d/ooniprobe.list
deb http://deb.torproject.org/torproject.org jessie main
====
file: /etc/apt/sources.list.d/skype-stable.list
deb [arch=amd64] https://repo.skype.com/deb stable main
====

hydrurga · 11-28-2018, 01:49 PM

Thanks. The first thing of note is that you are accessing the jessie-update repos twice:

Code:

deb http://ftp.debian.org/debian/ jessie-updates contrib main 
deb-src http://ftp.debian.org/debian/ jessie-updates contrib main

and

Code:

deb http://httpredir.debian.org/debian/ jessie-updates main contrib non-free 
deb-src http://httpredir.debian.org/debian/ jessie-updates main contrib non-free

One of these should be commented out or deleted, depending on whether you want to include non-free (I imagine that you do, so comment out the first).

Also, you're accessing the main repos twice:

Code:

deb http://httpredir.debian.org/debian/ jessie main contrib non-free

and

Code:

deb http://ftp.de.debian.org/debian jessie main

The main sources.list file is a bit messy overall. See https://wiki.debian.org/SourcesList#...e_sources.list for an idea about how it should be organised (replace "stretch" with "jessie"). If there is no specific software that you require from jessie-backports then you should comment out/delete that repo.

In addition, to determine which repo your system is trying to install one of the packages you listed in your first post from, libgnutls-openssl27, can you provide the output from the following:

Code:

apt-cache policy libgnutls-openssl27

hack3rcon · 12-02-2018, 06:28 AM

"deb" and "deb-src" are some?

hydrurga · 12-02-2018, 06:38 AM

Quote:

Originally Posted by hack3rcon

"deb" and "deb-src" are some?

If you mean the "same", no. The deb repos refer to the binaries (deb packages), while deb-src refers to the source code packages. If you never download source code from the repos, you can comment out or remove the deb-src entries if you want.