2

Updating repositories with apt update fails since the public keys of several signatures are not available.

$ sudo apt update
Get:1 http://security.debian.org/debian-security stretch/updates InRelease [94.3 kB]
Ign:2 http://deb.debian.org/debian stretch InRelease                                                                              
Hit:3 http://deb.debian.org/debian stretch Release                                                                                
Ign:4 http://ftp.fr.debian.org/debian stretch InRelease                                                                           
Ign:6 http://ftp.fr.debian.org/debian jessie InRelease                                                                            
Hit:7 https://fr.archive.ubuntu.com/ubuntu bionic InRelease                                                                       
Hit:8 http://ftp.fr.debian.org/debian stretch Release                                                                             
Get:5 http://ftp.fr.debian.org/debian stretch-updates InRelease [91.0 kB]                                                         
Hit:9 https://riot.im/packages/debian stretch InRelease                                                                           
Hit:10 http://ftp.fr.debian.org/debian jessie Release                                                                             
Err:1 http://security.debian.org/debian-security stretch/updates InRelease                                                        
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY 8B48AD6246925553
Get:11 https://mega.nz/linux/MEGAsync/Debian_9.0 ./ InRelease [1,480 B]                                                           
Ign:12 http://download.opensuse.org/repositories/home:/strycore/Debian_9.0 ./ InRelease                                           
Hit:13 http://download.opensuse.org/repositories/home:/strycore/Debian_9.0 ./ Release                                             
Err:14 http://deb.debian.org/debian stretch Release.gpg                           
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY EF0F382A1A7B6500
Get:15 https://content.runescape.com/downloads/ubuntu trusty InRelease [2,236 B]
Err:16 http://ftp.fr.debian.org/debian stretch Release.gpg
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY EF0F382A1A7B6500
Err:9 https://riot.im/packages/debian stretch InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E019645248E8F4A1
Err:5 http://ftp.fr.debian.org/debian stretch-updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010
Err:17 http://ftp.fr.debian.org/debian jessie Release.gpg
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY CBF8D6FD518E17E1
Err:11 https://mega.nz/linux/MEGAsync/Debian_9.0 ./ InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4B4E7A9523ACD201
Err:18 http://download.opensuse.org/repositories/home:/strycore/Debian_9.0 ./ Release.gpg
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 2F7F0DA5FD5B64B9
Err:15 https://content.runescape.com/downloads/ubuntu trusty InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7373B12CE03BEB4B
Reading package lists... Done 
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://security.debian.org/debian-security stretch/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY 8B48AD6246925553
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.debian.org/debian stretch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY EF0F382A1A7B6500
W: Skipping acquire of configured file 'xenial/binary-amd64/Packages' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: Skipping acquire of configured file 'xenial/binary-i386/Packages' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: Skipping acquire of configured file 'xenial/i18n/Translation-en_US' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: Skipping acquire of configured file 'xenial/i18n/Translation-en' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: Skipping acquire of configured file 'xenial/dep11/Components-amd64.yml' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: Skipping acquire of configured file 'xenial/dep11/icons-64x64.tar' as repository 'https://fr.archive.ubuntu.com/ubuntu bionic InRelease' doesn't have the component 'xenial' (component misspelt in sources.list?)
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://ftp.fr.debian.org/debian stretch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY EF0F382A1A7B6500
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://riot.im/packages/debian stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E019645248E8F4A1
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://ftp.fr.debian.org/debian stretch-updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://ftp.fr.debian.org/debian jessie Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010 NO_PUBKEY CBF8D6FD518E17E1
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://mega.nz/linux/MEGAsync/Debian_9.0 ./ InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4B4E7A9523ACD201
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://download.opensuse.org/repositories/home:/strycore/Debian_9.0 ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 2F7F0DA5FD5B64B9
W: GPG error: https://content.runescape.com/downloads/ubuntu trusty InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7373B12CE03BEB4B
E: The repository 'https://content.runescape.com/downloads/ubuntu trusty InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

I tried to update the keys without keyring.debian.org

$ gpg  --recv-keys 9D6D8F6BC857C906
gpg: key 9D6D8F6BC857C906: 12 signatures not checked due to missing keys
gpg: key 9D6D8F6BC857C906: "Debian Security Archive Automatic Signing Key (8/jessie) <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

and with

$ gpg --keyserver keyring.debian.org --recv-keys 9D6D8F6BC857C906
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

ca-certificates is up-to-date with version 20180409 as well as debian-keyring with version 2018.03.24.

I have also deleted /etc/apt/trusted.gpg as per https://serverfault.com/q/851724.

@Stephen Kitt's request:

$ ls -la /etc/apt/trusted.gpg.d
total 28
drwxr-xr-x 2 root root  4096 Jan  2 10:42 .
drwxr-xr-x 6 root root  4096 Jan  2 11:06 ..
-rw-r--r-- 1 root root 10345 Jan  2 10:42 ubuntu-keyring-2012-archive.gpg
-rw-r--r-- 1 root root  2796 Feb  6  2018 ubuntu-keyring-2012-archive.gpg~
-rw-r--r-- 1 root root  2794 Feb  6  2018 ubuntu-keyring-2012-cdimage.gpg

$ apt policy debian-archive-keyring
debian-archive-keyring:
  Installed: 2017.7ubuntu1
  Candidate: 2017.7ubuntu1
  Version table:
 *** 2017.7ubuntu1 500
        500 https://fr.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages
        500 https://fr.archive.ubuntu.com/ubuntu bionic/universe i386 Packages
        100 /var/lib/dpkg/status
     2017.5 500
        500 http://ftp.fr.debian.org/debian stretch/main amd64 Packages
        500 http://ftp.fr.debian.org/debian stretch/main i386 Packages
        500 http://deb.debian.org/debian stretch/main amd64 Packages
        500 http://deb.debian.org/debian stretch/main i386 Packages
     2017.5~deb8u1 500
        500 http://ftp.fr.debian.org/debian jessie/main amd64 Packages
        500 http://ftp.fr.debian.org/debian jessie/main i386 Packages

How do I resolve the issue of importing the proper keys?

Improve this question
2
  • Could you edit your question to show the output of ls -l /etc/apt/trusted.gpg.d, and apt policy debian-archive-keyring?
    – Stephen Kitt
    Jan 2, 2019 at 11:21
  • I have included the output @StephenKitt.
    – Exercise To The Reader
    Jan 2, 2019 at 11:24

2 Answers 2

Reset to default
6

You need to install Debian’s version of debian-archive-keyring, the package containing the archive keys. You currently have Ubuntu’s. (debian-keyring contains the developers’ keys.)

You’ll probably have to download it manually and install it using dpkg -i (as root, or using sudo).

As a longer-term fix, you should either drop Bionic from your repositories, or configure pinning correctly so that it isn’t used as an upgrade candidate by default.

Improve this answer
4
  • Should I delete Ubuntu's keyring? Or maybe reinstall them after updating the repositories?
    – Exercise To The Reader
    Jan 2, 2019 at 11:36
  • Installing the Debian keyring package will remove the Ubuntu keyring; you can re-install it by installing the ubuntu-archive-keyring package instead.
    – Stephen Kitt
    Jan 2, 2019 at 12:22
  • I manually installed debian-archive-keyring from the official website. Running apt update again fails to access the component sid. As a result: Skipping acquire of configured file 'sid/binary-i386/Packages' as repository 'http://deb.debian.org/debian stretch InRelease' doesn't have the component 'sid' (component misspelt in sources.list?)
    – Exercise To The Reader
    Jan 2, 2019 at 20:16
  • That’s probably another problem, a misconfigured repository; please ask another question.
    – Stephen Kitt
    Jan 2, 2019 at 20:23
-3

try following in case nothing works:

apt update --allow-unauthenticated
Improve this answer
1
  • 1
    I haven't downvoted you but I suspect there are security implications for using a flag with that name. You should edit the answer to explain how this solves the problem (and highlight any potential consequences).
    – Anthony Geoghegan
    Sep 25, 2019 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .