Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Sometimes when you try to apt-get install a program, you get a warning message about how some packages couldn't be authenticated.
Doing an apt-get update will sometimes fix the problem, but sometimes it won't.
How does apt-get update fix this problem?
Does this type of authentication necessarily involve ssl?
Why does it sometimes not fix the problem?
Basically, each package is signed using GPG. Keys are provided through different Debian packages (look for *-keyring packages).
You can see currently installed keys using apt-key.
Additional keys are used when you are using 3rd party repositories such as Ubuntu PPA or others (Google, Skype, Valve...).
Some 3rd party repositories may also contain not signed packages which lead into this apt warning. Be particularly careful when using these repositories as a malicious Debian package you install can definitively compromise your system.
See this page (apt-secure) for more information.
Regarding apt-get update effect on this, it retrieves from the server up-to-date information regarding packages which can fix previous errors such as unsigned packages, expired GPG key and other bugs that may break the authentification chain.
