Untrusted package apt-transport-https

Question

I am using Debian wheezy and I would like to install the package apt-transport-https, which allows to access apt repositories through the https protocol.

What really puzzles me is that the apt-get gives me the following message:

$ sudo apt-get install apt-transport-https
...
The following NEW packages will be installed:
  apt-transport-https
0 upgraded, 1 newly installed, 0 to remove and 14 not upgraded.
Need to get 109 kB of archives.
After this operation, 166 kB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
  apt-transport-https
Install these packages without verification [y/N]?

I pressed N because I would like to clarify this before installing the package. Why is no authentication information for this package provided? I would expect this to be the default, especially for a package that provides a secure transfer protocol.

Answer 1

When running apt-get update for a https mirror without apt-transport-https installed, you probably invalidated your cached (sources) data, as a side effect invalidating the signatures - this should fix itself after running "apt-get update" again (you might have to revert to a non-https mirror temporarily).

Answer 2

Debian adds keys that will be used to sign the packages in the future to the debian-archive-keyring package. That's why you need this package updated. If apt-get update won't work, you might have to (re)install keyrings:

sudo apt-get remove debian-keyring debian-archive-keyring

sudo apt-get clean

sudo apt-get update

sudo apt-get -y install debian-keyring debian-archive-keyring

Source: server fault