Cannot update/install apps "untrusted packages"

Question

Possible Duplicate:
What is the easiest way to resolve apt-get BADSIG GPG errors?

I'm struggling to get my ubuntu to update / download any apps, as it always displays "Requires installation of untrusted packages". I have read on other posts that the command should solve the problem but it hasnt:

sudo apt-get update

This is the result

aaron@Aaron-Laptop:~$ sudo apt-get update
[sudo] password for aaron: 
Ign http://security.ubuntu.com precise-security InRelease
Ign http://archive.canonical.com precise InRelease                  
Ign http://extras.ubuntu.com precise InRelease                      
Ign http://gb.archive.ubuntu.com precise InRelease                   
Ign http://gb.archive.ubuntu.com precise-updates InRelease           
Hit http://extras.ubuntu.com precise Release.gpg 

[cut a bit out here because it seemed unnecessary?]               

Fetched 69.2 kB in 2min 0s (572 B/s)
Reading package lists... Done
W: GPG error: http://gb.archive.ubuntu.com precise Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://gb.archive.ubuntu.com precise-updates Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>

          W: Failed to fetch http://gb.archive.ubuntu.com/ubuntu/dists/precise-backports/Release.gpg  rename failed, No such file or directory ( -> /var/lib/apt/lists/partial/gb.archive.ubuntu.com_ubuntu_dists_precise-backports_Release.gpg).

W: Failed to fetch http://gb.archive.ubuntu.com/ubuntu/dists/precise-updates/Release  

W: Some index files failed to download. They have been ignored, or old ones used instead.
aaron@Aaron-Laptop:~$

So my question is, what can I do to fix it ? Thanks in advance, Aaron

EDIT

After using the command aaron@Aaron-Laptop:~$ sudo apt-get -o Acquire::http::No-Cache=True -o Acquire::BrokenProxy=true update

The result i got was :
      W: GPG error: http://mirrors.ccs.neu.edu precise Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
W: Conflicting distribution: http://mirrors.ccs.neu.edu precise-updates Release (expected precise-updates but got precise)
W: GPG error: http://mirrors.ccs.neu.edu precise-security Release: Unknown error executing gpgv
W: Failed to fetch http://mirrors.ccs.neu.edu/ubuntu/dists/precise-security/Release.gpg  rename failed, No such file or directory ( -> /var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-security_Release.gpg).

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_binary-i386_Packages  Hash Sum mismatch

E : Some index files failed to download. They have been ignored, or old ones used instead.

And the other

aaron@Aaron-Laptop:~$ apt-key list
gpg: fatal: /home/aaron/.gnupg: directory does not exist!
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768
aaron@Aaron-Laptop:~$

think this is what you wanted :

aaron@Aaron-Laptop:~$ apt-key list
gpg: fatal: /home/aaron/.gnupg: directory does not exist!
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768
aaron@Aaron-Laptop:~$ ls -al /etc/apt/trusted.gpg*
-rw-r--r-- 1 root root 18402 Jan 28 19:10 /etc/apt/trusted.gpg
-rw-r--r-- 1 root root 19835 Jan 28 18:39 /etc/apt/trusted.gpg~

/etc/apt/trusted.gpg.d:
total 8
drwxr-xr-x 2 root root 4096 Apr 20  2012 .
drwxr-xr-x 6 root root 4096 Jan 28 19:10 ..

aaron@Aaron-Laptop:~$ apt-key --keyring /etc/apt/trusted.gpg list
gpg: fatal: /home/aaron/.gnupg: directory does not exist!
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768
aaron@Aaron-Laptop:~$

I inputted the command you told me to giving me :

    aaron@Aaron-Laptop:~$ gpg --keyserver pgpkeys.mit.edu --recv-key 40976EAF C0B21F32 3E5C1192 # 2004, 2012 and extras key
   gpg: requesting key 40976EAF from hkp server pgpkeys.mit.edu
   gpg: requesting key C0B21F32 from hkp server pgpkeys.mit.edu
   gpg: requesting key 3E5C1192 from hkp server pgpkeys.mit.edu
   gpgkeys: key 40976EAF not found on keyserver
   gpg: key C0B21F32: "Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>" not changed
   gpg: key 3E5C1192: "Ubuntu Extras Archive Automatic Signing Key <ftpmaster@ubuntu.com>" not changed
   gpg: Total number processed: 2
   gpg:              unchanged: 2
   aaron@Aaron-Laptop:~$ gpg -a --export 40976EAF | sudo apt-key add -
   gpg: no valid OpenPGP data found.
   aaron@Aaron-Laptop:~$ gpg -a --export C0B21F32 | sudo apt-key add -
    OK
   aaron@Aaron-Laptop:~$ gpg -a --export 3E5C1192 | sudo apt-key add -
    OK
   aaron@Aaron-Laptop:~$

should i now run "sudo apt-get update" ? or is there anything else I should do first ?

Ok did the new thing to then did the update and got this :

W: GPG error: http://mirrors.ccs.neu.edu precise Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
W: Conflicting distribution: http://mirrors.ccs.neu.edu precise-updates Release (expected precise-updates but got precise)
W: GPG error: http://mirrors.ccs.neu.edu precise-security Release: Unknown error executing gpgv
W: Failed to fetch http://mirrors.ccs.neu.edu/ubuntu/dists/precise-backports/Release.gpg  rename failed, No such file or directory ( -> /var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-backports_Release.gpg).

W: Failed to fetch http://mirrors.ccs.neu.edu/ubuntu/dists/precise-security/Release.gpg  rename failed, No such file or directory ( -> /var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-security_Release.gpg).

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_source_Sources  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_main_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_restricted_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_universe_binary-i386_Packages  Hash Sum mismatch

W: Failed to fetch bzip2:/var/lib/apt/lists/partial/mirrors.ccs.neu.edu_ubuntu_dists_precise-updates_multiverse_binary-i386_Packages  Hash Sum mismatch

E: Some index files failed to download. They have been ignored, or old ones used instead.

Any Ideas? :/

Welcome to Ask Ubuntu! This is a security mechanism in APT preventing you to download untrusted data. It seems that the "gb" download site (mirror) has corrupted, compromised or your network is. Try [selecting another mirror](http://askubuntu.com/a/37825/88802). Please do not proceed. Somebody could be doing something very nasty (man-in-the-middle attack). — gertvdijk, Jan 28 '13 at 16:36
@UriHerrera The accepted answer there seems very dangerous for regular Ubuntu mirrors. This enables man-in-the-middle attackes to be successful in their attempt. — gertvdijk, Jan 28 '13 at 16:38
@UriHerrera All the steps not fiddling with APT keys are fine. I would recommend trying [this answer](http://askubuntu.com/a/64544/88802) first. — gertvdijk, Jan 28 '13 at 16:46
Oh oh! `apt-key list` shows an empty set. Your keyring is completely empty. It should output at least `/etc/apt/trusted.gpg ` and a list of keys in there. I'll look into a way to restoring this... This does not break by itself! What did you do? — gertvdijk, Jan 28 '13 at 19:33
I honestly have no idea (new to linux) just been following forum posts all afternoon trying to sort the error. — aarondobie555, Jan 28 '13 at 19:34
Can you list the output of `ls -al /etc/apt/trusted.gpg*` and `apt-key --keyring /etc/apt/trusted.gpg list` (if that differs from the other `apt-key` output earlier) — gertvdijk, Jan 28 '13 at 19:36

gertvdijk · Answer 1 · 2013-01-28T20:34:49.323

0

The /etc/apt/trusted.gpg file should be readable by apt-key and contain a set of public keys of Ubuntu. In your case this seems not to be readable. How your system ends up in such a state is a question on its own, but should never happen.

To recreate the set of keys, you could try this:

gpg --keyserver pgpkeys.mit.edu --recv-key 437D05B5 C0B21F32 3E5C1192 # 2004, 2012 and extras key
gpg -a --export 437D05B5 | sudo apt-key add -
gpg -a --export C0B21F32 | sudo apt-key add -
gpg -a --export 3E5C1192 | sudo apt-key add -

Then just run

sudo apt-get update

which should run without the errors you got previously.

edited Jan 28 '13 at 20:34

answered Jan 28 '13 at 19:58

gertvdijk

67,007
33
188
283

@aarondobie555 I'm terribly sorry about the wrong key listed in my answer (now fixed!) - these hexadecimal codes all look the same sometimes. Run `gpg --keyserver pgpkeys.mit.edu --recv-key 437D05B5 && gpg -a --export 437D05B5 | sudo apt-key add -` to correct in your situation. Also added the following steps. – gertvdijk Jan 28 '13 at 20:36
completed the above code , still have an error code, i posted output above . Is there anyway you could maybe access my laptop ? if that would be easier for you ? because im normally fairly good with computer stuff, but with linux i have no real idea of what im doing . – aarondobie555 Jan 28 '13 at 21:07
< sorry , forgot to tag – aarondobie555 Jan 28 '13 at 21:43
Also seeing as i've only had ubuntu running for a few days - would just reinstalling a new copy of ubuntu on the same partition solve the problem ?(as i dont really have any files to loose? – aarondobie555 Jan 28 '13 at 21:51
Thanks for all the help , but decided to go for a full reinstallation as i couldn't sort it . – aarondobie555 Jan 29 '13 at 13:46

Cannot update/install apps "untrusted packages"

1 Answers1