Ubuntu 16.10: WARNING: The following packages cannot be authenticated! #5287

varac · 2016-10-30T08:54:27Z

Expected behaviour

The owncloud-client ubuntu 16.10 package should get installed in a safe way.

Actual behaviour

Apt is unable to authenticate the debian package.

Steps to reproduce

Go to the owncloud website, and follow the instructions to download the ubuntu 16.10 client

So I have the new 557BEFF9 signing key installed (apt-key shows here the long fingerprint but the last 8 chars show the short keyid):

--- ~ » apt-key list | grep -B 2 "isv:ownCloud OBS Project"
pub   rsa2048 2016-09-25 [SC] [expires: 2018-12-04]
      1B07 204C D71B 690D 409F  57D2 4ABE 1AC7 557B EFF9
uid           [ unknown] isv:ownCloud OBS Project <isv:ownCloud@build.opensuse.org>

Updating the package cache and trying to install owncloud-client results in an apt warning:

--- ~ » sudo apt update
Hit:1 http://archive.ubuntu.com/ubuntu yakkety InRelease
Hit:2 http://archive.ubuntu.com/ubuntu yakkety-updates InRelease                                              
Hit:3 http://deb.debian.org/debian jessie-backports InRelease                                                 
Get:5 http://archive.ubuntu.com/ubuntu yakkety-security InRelease [93.3 kB]                               
Ign:6 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  InRelease            
Hit:7 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Release
Get:8 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Release.gpg [481 B]
Hit:9 http://archive.ubuntu.com/ubuntu yakkety-backports InRelease                              
Hit:4 https://packages.gitlab.com/runner/gitlab-ci-multi-runner/ubuntu yakkety InRelease
Fetched 93.8 kB in 1s (52.4 kB/s)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
4 packages can be upgraded. Run 'apt list --upgradable' to see them.

--- ~ » sudo apt-get install owncloud-client
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libqt5keychain0 owncloud-client-data
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
  libowncloudsync0 libqtkeychain1
The following packages will be REMOVED:
  nautilus-owncloud
The following NEW packages will be installed:
  libqtkeychain1
The following packages will be upgraded:
  libowncloudsync0 owncloud-client
2 upgraded, 1 newly installed, 1 to remove and 2 not upgraded.
Need to get 1,386 kB of archives.
After this operation, 307 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
WARNING: The following packages cannot be authenticated!
  libqtkeychain1 owncloud-client libowncloudsync0
Install these packages without verification? [y/N]

I looked at the Release.gpg file and it's indeed signed by the right key, so I'm really out of ideas here.
@FlorianFranzen reported quite the same here: #5055 (comment)

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/38793140-ubuntu-16-10-warning-the-following-packages-cannot-be-authenticated?utm_campaign=plugin&utm_content=tracker%2F216457&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F216457&utm_medium=issues&utm_source=github).

The text was updated successfully, but these errors were encountered:

ghost · 2016-10-30T09:44:01Z

@varac No need to create this issue here. As you previously had installed the sync client and the old key see the following comment how to workaround this issue in apt: #5055 (comment)

drohhyn · 2016-10-30T10:22:18Z

I don't think it is fixed @RealRancor.

I just installed Ubuntu 16.10 from scratch, added the repository as described here https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client and tried to install (before getting the key). After installing the Key (as described in the same page) I still got the same error as @varac above:

$ sudo apt-get install owncloud-client
[sudo] password for USER: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  libowncloudsync0 libqt4-opengl libqtkeychain1 libqtwebkit4
  owncloud-client-l10n
The following NEW packages will be installed:
  libowncloudsync0 libqt4-opengl libqtkeychain1 libqtwebkit4 owncloud-client
  owncloud-client-l10n
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 11,0 MB of archives.
After this operation, 44,8 MB of additional disk space will be used.
Do you want to continue? [Y/n] 
WARNING: The following packages cannot be authenticated!
  libqtkeychain1 libowncloudsync0 owncloud-client-l10n owncloud-client
Install these packages without verification? [y/N] 
E: Some packages could not be authenticated

So the workaround was removing the repository and re-add it, but that's not the way you could expect from all users.

Kind regards

ghost · 2016-10-30T10:34:32Z

@varac Feel free to report a bug to Ubuntu about the incorrect handling of repositories. How should such limitations of an Operating system be fixed by oC?

drohhyn · 2016-10-30T11:07:01Z

@RealRancor I think your comment was for me, so: for me it's an oC issue because it happens only with this repository, never had this anywhere else.

ghost · 2016-10-30T12:01:31Z

@drohhyn Ah, yes. If you think there is an issue with the repository itself you might want to report that to the OpenSUSE guys as they are providing/maintaining the repositories.

The repositories are correctly signed so its most likely either a limitation / bug in Ubuntu or the OBS from OpenSUSE. Both can't be fixed by the oC guys

ghost · 2016-10-30T16:22:59Z

Just as a follow-up to show that there is at least no issue with the repository itself but with the way you're doing the steps or other issues on the base ubuntu system:

sudo rm /etc/apt/sources.list.d/owncloud*
sudo apt-key remove 557BEFF9
rm Release.key
sudo apt-get update
No issues about wrong keys + no repositories containing "owncloud" during 4. are showing up
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10/ /' > /etc/apt/sources.list.d/owncloud-client.list"
sudo apt-get update
W: GPG error: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10 Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4ABE1AC7557BEFF9 is showing up correctly
wget http://download.opensuse.org/repositories/isv:ownCloud:desktop/Ubuntu_16.10/Release.key
sudo apt-key add - < Release.key
sudo apt-get update
No issues is shown about wrong / missing signatures
sudo apt-get install owncloud-client
Package is installed without any issues:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  libowncloudsync0 owncloud-client-l10n
The following NEW packages will be installed:
  libowncloudsync0 owncloud-client owncloud-client-l10n
0 upgraded, 3 newly installed, 0 to remove and 135 not upgraded.
Need to get 1,669 kB of archives.
After this operation, 6,406 kB of additional disk space will be used.
Do you want to continue? [Y/n]

I also couldn't even reproduce the "So the workaround was removing the repository and re-add it" as shown in the steps above (i had added the repository and ran apt-get update before even adding the key later).

@drohhyn @varac Mind to post the output of the following command:

apt-cache policy libowncloudsync0 owncloud-client owncloud-client-l10n

varac · 2016-10-30T18:48:25Z

@RealRancor Thx ! I removed all owncloud related things (apt-key, sources.list), readding them and then installing the package worked for me! I don't have an explanation for this but I don't mind too much.

@RealRancor As a direct feedback, I think it's not very user friendly to point ppl to Ubuntu or OpenSuse, and I agree with @drohhyn here that this should be taken care of by oC as it's also for me the very first time I experience this.

Here's the outpt you asked for:

--- ~ » apt-cache policy libowncloudsync0 owncloud-client owncloud-client-l10n
libowncloudsync0:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
owncloud-client:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
owncloud-client-l10n:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
        500 http://archive.ubuntu.com/ubuntu yakkety/universe i386 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
        100 http://deb.debian.org/debian jessie-backports/main i386 Packages

ghost · 2016-10-30T18:56:55Z

As a direct feedback, I think it's not very user friendly to point ppl to Ubuntu or OpenSuse, and I agree with @drohhyn here that this should be taken care of by oC as it's also for me the very first time I experience this.

@varac As explained the repository is maintained by opensuse obs (see the opensuse.org in the link) so there is nothing what can be done here from oC side.

If removing and adding the repos is solving this issue then it also shows that this is somehow a limitation of your operating system and not the repositories. This is also nothing what can be solved from oC.

Because of that facts you got pointed to ubuntu/opensuse as not every issue out there can be solved or being taken care of in the scope of ownCloud.

ghost · 2016-10-30T20:02:02Z

So to sum-up there are currently two issues here:

Ubuntu seems to be not able to handle an added repository if an apt-get update is executed before the actual repository key is added. For this a bugreport at https://bugs.launchpad.net/ubuntu/+source/apt needs to be created.
The instructions at https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client is suggesting the wrong steps leading to this issue. This is an auto generated text and that text is out of the control of ownCloud so a new bugreport at https://github.com/openSUSE/software-o-o/issues needs to be created.

ghost · 2016-10-31T10:11:22Z

@guruz From my PoV the "packaging" label and assignment is not needed here for the reasons explained in the last comment above.

jnweiger · 2016-10-31T15:07:18Z

@crrodriguez looked into fixing the instructions at https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client any progress here?

jnweiger · 2016-10-31T17:14:11Z

Confirmed @RealRancor s observation:
Ubuntu seems to be not able to handle an added repository if an apt-get update is executed before the actual repository key is added.

It is important to add the repository after the key. This is a bug in 16.10.

I cannot reproduce the issue after the key was once added to the system:
Removing the key, adding the repo, gives the warning as expected. Then re-adding the key while the repo is already there, installation succeeds as expected. :-(

The cause is: Ubuntu forgets to re-scan the repo in the first place. apt-get update says things like: Ign:2 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10 InRelease
A workaround idea is to find a way how to force a re-scan.

SimonChristopherCropper · 2016-11-28T01:33:09Z

I encountered the same authentication error but on 16.04 and tried every workaround offered. Your comments above made me think about NOT updating until the repo and key are added. This is the sequence that after a hour I was able to rid myself of all errors!

sudo rm /etc/apt/sources.list.d/owncloud*
sudo apt-key remove 557BEFF9
rm Release.key
sudo apt-get update
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/ /' > /etc/apt/sources.list.d/owncloud-client.list"
wget http://download.opensuse.org/repositories/isv:ownCloud:desktop/Ubuntu_16.04/Release.key
sudo apt-key add - < Release.key
sudo apt-get update
sudo apt-get install owncloud-client

ghost · 2016-11-28T07:42:36Z

@SimonChristopherCropper Yes, thats the correct sequence.

From what i can see this bug was reported a few month ago to Ubuntu:

https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1592040

xZise · 2016-12-22T14:43:46Z

I had the same issue on 16.04 and for me it did to just uncomment the line in /etc/apt/sources.list.d/owncloud, do an sudo apt-get update and then to un-uncomment the line again and doing an update again. I obviously already had added the key.

killerswan · 2017-04-19T10:38:39Z

FWIW I'd just like to thank all of you for diagnosing this problem! Helped me just now.

crrodriguez · 2017-06-30T21:38:34Z

Key issues were solved a while ago.

varac mentioned this issue Oct 30, 2016

Repo: Weak digest & Invalid signatures #5055

Closed

guruz added the packaging label Oct 31, 2016

guruz assigned jnweiger Oct 31, 2016

guruz added Known Issue / Workaround and removed packaging labels Oct 31, 2016

jnweiger assigned crrodriguez and unassigned jnweiger Oct 31, 2016

guruz added the packaging label Nov 16, 2016

killerswan mentioned this issue Apr 19, 2017

documentation: Debian packages on Bintray require public key setup (to avoid GPG or authentication errors) ponylang/ponyc#1825

Closed

crrodriguez closed this as completed Jun 30, 2017

grokcode mentioned this issue Dec 30, 2017

Fix apt-key error joemiller/puppet-newrelic#13

Open

nixjdm mentioned this issue Feb 21, 2018

Cloud errors terminal-labs/rambo#268

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ubuntu 16.10: WARNING: The following packages cannot be authenticated! #5287

Ubuntu 16.10: WARNING: The following packages cannot be authenticated! #5287

varac commented Oct 30, 2016 •

edited by DeepDiver1975

Loading

ghost commented Oct 30, 2016

drohhyn commented Oct 30, 2016 •

edited

Loading

ghost commented Oct 30, 2016

drohhyn commented Oct 30, 2016

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

varac commented Oct 30, 2016

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 31, 2016

jnweiger commented Oct 31, 2016

jnweiger commented Oct 31, 2016 •

edited

Loading

SimonChristopherCropper commented Nov 28, 2016

ghost commented Nov 28, 2016

xZise commented Dec 22, 2016

killerswan commented Apr 19, 2017

crrodriguez commented Jun 30, 2017

Ubuntu 16.10: WARNING: The following packages cannot be authenticated! #5287

Ubuntu 16.10: WARNING: The following packages cannot be authenticated! #5287

Comments

varac commented Oct 30, 2016 • edited by DeepDiver1975 Loading

Expected behaviour

Actual behaviour

Steps to reproduce

ghost commented Oct 30, 2016

drohhyn commented Oct 30, 2016 • edited Loading

ghost commented Oct 30, 2016

drohhyn commented Oct 30, 2016

ghost commented Oct 30, 2016 • edited by ghost Loading

ghost commented Oct 30, 2016 • edited by ghost Loading

varac commented Oct 30, 2016

ghost commented Oct 30, 2016 • edited by ghost Loading

ghost commented Oct 30, 2016 • edited by ghost Loading

ghost commented Oct 31, 2016

jnweiger commented Oct 31, 2016

jnweiger commented Oct 31, 2016 • edited Loading

SimonChristopherCropper commented Nov 28, 2016

ghost commented Nov 28, 2016

xZise commented Dec 22, 2016

killerswan commented Apr 19, 2017

crrodriguez commented Jun 30, 2017

varac commented Oct 30, 2016 •

edited by DeepDiver1975

Loading

drohhyn commented Oct 30, 2016 •

edited

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

ghost commented Oct 30, 2016 •

edited by ghost

Loading

jnweiger commented Oct 31, 2016 •

edited

Loading