Home / server / Questions / 20728
Accepted
chaos
Asked: 2009-06-06 10:47:02 +0800 CST

Why does apt-get update tell me to run apt-get update?

  • 772

So I have this going on:

# apt-get update
Get:1 http://ftp.us.debian.org etch Release.gpg [1032B]                     
Hit http://ftp.us.debian.org etch Release                                        
(...bunch more of this elided...)
Hit http://ftp.us.debian.org etch/contrib Sources
Fetched 68.8kB in 1s (37.4kB/s)
Reading package lists... Done
W: There is no public key available for the following key IDs:
9AA38DCD55BE302B
W: GPG error: http://ftp.us.debian.org etch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9AA38DCD55BE302B
W: You may want to run apt-get update to correct these problems

Apparently I can't run apt-get update because of a problem that apt-get wants me to run apt-get update to fix, which is displeasing. How do I correct this?

linux debian apt gpg

5 Answers

  1. Best Answer

    Try doing this and running apt-get again:

    apt-key update

    apt-key is a program that is used to manage a keyring of gpg keys for secure apt. The keyring is kept in the file /etc/apt/trusted.gpg (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). apt-key can be used to show the keys in the keyring, and to add or remove a key.

    Further info on the Debian wiki: http://wiki.debian.org/SecureApt

    If that doesn't work, try:

    gpg --keyserver wwwkeys.eu.pgp.net --recv-keys 9AA38DCD55BE302B
apt-key add /root/.gnupg/pubring.gpg
apt-get update
    • 16

  2. or do a sudo apt-get install debian-archive-keyring first.

    after that you can continue a normaly

    • 12

  3. To ensure the origin of package that you download, APT will want to verify the signatures of the Release file. If it can't verify it, it will complain with the message that you saw. In that case, you have to install the corresponding GPG key so that APT can verify the file properly. Unfortunately you should not blindly download any key as you really want to allow only trusted keys that are owned by the repository owner. Thus you must download it in a way that ensures its origin, and simply downloading it with gpg --recv-key doesn't ensure that.

    Installing a new key is done with apt-key add <key-file>. Most non-official repositories provide you the key on their website and give you instructions like this (the URL differs of course) :

    wget -O - http://ftp-master.debian.org/keys/archive-key-5.0.asc | sudo apt-key add -

    In the case of an official Debian mirror, you should automatically have the right key installed, it's contained in the package debian-archive-keyring and its configuration activates the keys automatically. So ensure you have it installed, and ensure it's up-to-date:

    apt-get install debian-archive-keyring

    If you don't trust your mirror, you can also install it only after having installed the right key with the previous method, I actually gave the URL of the official key that you needed.

    For more infos about how the Debian Archive Keys are handled you can check http://ftp-master.debian.org/keys.html.

    • 6

  4. I had the same problem on Juanty 9.04 64 bit. Tried several suggestions but this did the trick :

    wget -O - http://ftp-master.debian.org/keys/archive-key-5.0.asc | sudo apt-key add -

    The do :

    sudo apt-get update

    Thanks

    Fanus

    • 3

  5. I had this problem due to a transparent proxy giving me an old version of the GPG key, I solved it by using wget to force the proxy to get a new version, e.g.

    wget --no-cache -O /tmp/Z http://security.debian.org/dists/lenny/updates/Release.gpg
wget --no-cache -O /tmp/Z2 http://security.debian.org/dists/lenny/updates/Release

    so I'd hope that in your case the following commands would solve it:-

    wget --no-cache -O /tmp/Z http://ftp.us.debian.org/dists/etch/Release.gpg
wget --no-cache -O /tmp/Z2 http://ftp.us.debian.org/dists/etch/Release

    Obviously we are so far past Etch that this is no longer the case, but I'm documenting it here in case it helps someone out.

    • 2