Home / ubuntu / Questions / 1490711
Accepted
user105939
Asked: 2023-10-29 05:15:24 +0800 CST

Why/how is it possible to "hide" PPA's ? sounds unsafe

  • 772

I have installed "beyond compare" from scooter software.

now, on apt update I get:

Ign:17 https://www.scootersoftware.com bcompare4 InRelease                                            
Get:18 https://www.scootersoftware.com bcompare4 Release [1 731 B]
Get:19 https://www.scootersoftware.com bcompare4 Release.gpg [836 B]
Err:19 https://www.scootersoftware.com bcompare4 Release.gpg
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EC34ED227AFAE3F2
Fetched 327 kB in 1s (219 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up-to-date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://www.scootersoftware.com bcompare4 Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EC34ED227AFAE3F2
W: Failed to fetch https://www.scootersoftware.com/dists/bcompare4/Release.gpg  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EC34ED227AFAE3F2
W: Some index files failed to download. They have been ignored, or old ones used instead.

The issue is that I cannot see that source among my sources in the "Software & Updates" (GUI) - nor is it visible in /etc/apt/sources.list

So - this makes me think: what other PPA's may I have that I am not aware of? - this does not seem to be very wise/safe. I get it - I did install the software, but still, I'd expect the added source to be visible among PPA's ? - or am I missing something?

package-management

1 Answers

  1. Best Answer

    There are two places to check. ALL your apt sources are there:

    /etc/apt/sources.list
/etc/apt/sources.list.d/*

    In addition, all valid sources are listed when you run sudo apt update

    If your source isn't listed in those two places, then it's not a valid source for apt to use.

    If your source shows a warning when apt tries to use it, then apt cannot use it. (It's not a useful source) You should fix that source...or remove it.

    Keeping track of apt sources (including PPAs) is the human's responsibility. It cannot be delegated. It's an element of keeping your system secure. Apt is a helpful tool, but it cannot do your job for you.

    • 2