Client: Ubuntu 16.10: WARNING: The following packages cannot be authenticated!

Created on 30 Oct 2016 · 17Comments · Source: owncloud/client

Expected behaviour

The owncloud-client ubuntu 16.10 package should get installed in a safe way.

Actual behaviour

Apt is unable to authenticate the debian package.

Steps to reproduce

Go to the owncloud website, and follow the instructions to download the ubuntu 16.10 client

So I have the new 557BEFF9 signing key installed (apt-key shows here the long fingerprint but the last 8 chars show the short keyid):

--- ~ » apt-key list | grep -B 2 "isv:ownCloud OBS Project"
pub   rsa2048 2016-09-25 [SC] [expires: 2018-12-04]
      1B07 204C D71B 690D 409F  57D2 4ABE 1AC7 557B EFF9
uid           [ unknown] isv:ownCloud OBS Project <isv:[email protected]>

Updating the package cache and trying to install owncloud-client results in an apt warning:

--- ~ » sudo apt update
Hit:1 http://archive.ubuntu.com/ubuntu yakkety InRelease
Hit:2 http://archive.ubuntu.com/ubuntu yakkety-updates InRelease                                              
Hit:3 http://deb.debian.org/debian jessie-backports InRelease                                                 
Get:5 http://archive.ubuntu.com/ubuntu yakkety-security InRelease [93.3 kB]                               
Ign:6 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  InRelease            
Hit:7 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Release
Get:8 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Release.gpg [481 B]
Hit:9 http://archive.ubuntu.com/ubuntu yakkety-backports InRelease                              
Hit:4 https://packages.gitlab.com/runner/gitlab-ci-multi-runner/ubuntu yakkety InRelease
Fetched 93.8 kB in 1s (52.4 kB/s)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
4 packages can be upgraded. Run 'apt list --upgradable' to see them.

--- ~ » sudo apt-get install owncloud-client
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libqt5keychain0 owncloud-client-data
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
  libowncloudsync0 libqtkeychain1
The following packages will be REMOVED:
  nautilus-owncloud
The following NEW packages will be installed:
  libqtkeychain1
The following packages will be upgraded:
  libowncloudsync0 owncloud-client
2 upgraded, 1 newly installed, 1 to remove and 2 not upgraded.
Need to get 1,386 kB of archives.
After this operation, 307 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
WARNING: The following packages cannot be authenticated!
  libqtkeychain1 owncloud-client libowncloudsync0
Install these packages without verification? [y/N]

I looked at the Release.gpg file and it's indeed signed by the right key, so I'm really out of ideas here.
@FlorianFranzen reported quite the same here: https://github.com/owncloud/client/issues/5055#issuecomment-255029557

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Known Issue / Workaround packaging

Source

varac

Most helpful comment

I encountered the same authentication error but on 16.04 and tried every workaround offered. Your comments above made me think about NOT updating until the repo and key are added. This is the sequence that after a hour I was able to rid myself of all errors!

sudo rm /etc/apt/sources.list.d/owncloud*
sudo apt-key remove 557BEFF9
rm Release.key
sudo apt-get update
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/ /' > /etc/apt/sources.list.d/owncloud-client.list"
wget http://download.opensuse.org/repositories/isv:ownCloud:desktop/Ubuntu_16.04/Release.key
sudo apt-key add - < Release.key
sudo apt-get update
sudo apt-get install owncloud-client

SimonChristopherCropper on 28 Nov 2016

👍4 🎉2 😄1

All 17 comments

@varac No need to create this issue here. As you previously had installed the sync client and the old key see the following comment how to workaround this issue in apt: https://github.com/owncloud/client/issues/5055#issuecomment-255063655

ghost on 30 Oct 2016

I don't think it is fixed @RealRancor.

I just installed Ubuntu 16.10 from scratch, added the repository as described here https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client and tried to install (before getting the key). After installing the Key (as described in the same page) I still got the same error as @varac above:

$ sudo apt-get install owncloud-client
[sudo] password for USER: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  libowncloudsync0 libqt4-opengl libqtkeychain1 libqtwebkit4
  owncloud-client-l10n
The following NEW packages will be installed:
  libowncloudsync0 libqt4-opengl libqtkeychain1 libqtwebkit4 owncloud-client
  owncloud-client-l10n
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 11,0 MB of archives.
After this operation, 44,8 MB of additional disk space will be used.
Do you want to continue? [Y/n] 
WARNING: The following packages cannot be authenticated!
  libqtkeychain1 libowncloudsync0 owncloud-client-l10n owncloud-client
Install these packages without verification? [y/N] 
E: Some packages could not be authenticated

So the workaround was removing the repository and re-add it, but that's not the way you could expect from all users.

Kind regards

drohhyn on 30 Oct 2016

@varac Feel free to report a bug to Ubuntu about the incorrect handling of repositories. How should such limitations of an Operating system be fixed by oC?

ghost on 30 Oct 2016

@RealRancor I think your comment was for me, so: for me it's an oC issue because it happens only with this repository, never had this anywhere else.

drohhyn on 30 Oct 2016

@drohhyn Ah, yes. If you think there is an issue with the repository itself you might want to report that to the OpenSUSE guys as they are providing/maintaining the repositories.

The repositories are correctly signed so its most likely either a limitation / bug in Ubuntu or the OBS from OpenSUSE. Both can't be fixed by the oC guys

ghost on 30 Oct 2016

Just as a follow-up to show that there is at least no issue with the repository itself but with the way you're doing the steps or other issues on the base ubuntu system:

sudo rm /etc/apt/sources.list.d/owncloud*
sudo apt-key remove 557BEFF9
rm Release.key
sudo apt-get update
No issues about wrong keys + no repositories containing "owncloud" during 4. are showing up
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10/ /' > /etc/apt/sources.list.d/owncloud-client.list"
sudo apt-get update
W: GPG error: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10 Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4ABE1AC7557BEFF9 is showing up correctly
wget http://download.opensuse.org/repositories/isv:ownCloud:desktop/Ubuntu_16.10/Release.key
sudo apt-key add - < Release.key
sudo apt-get update
No issues is shown about wrong / missing signatures
sudo apt-get install owncloud-client
Package is installed without any issues:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  libowncloudsync0 owncloud-client-l10n
The following NEW packages will be installed:
  libowncloudsync0 owncloud-client owncloud-client-l10n
0 upgraded, 3 newly installed, 0 to remove and 135 not upgraded.
Need to get 1,669 kB of archives.
After this operation, 6,406 kB of additional disk space will be used.
Do you want to continue? [Y/n]

I also couldn't even reproduce the "So the workaround was removing the repository and re-add it" as shown in the steps above (i had added the repository and ran apt-get update before even adding the key later).

@drohhyn @varac Mind to post the output of the following command:

apt-cache policy libowncloudsync0 owncloud-client owncloud-client-l10n

ghost on 30 Oct 2016

@RealRancor Thx ! I removed all owncloud related things (apt-key, sources.list), readding them and then installing the package worked for me! I don't have an explanation for this but I don't mind too much.

@RealRancor As a direct feedback, I think it's not very user friendly to point ppl to Ubuntu or OpenSuse, and I agree with @drohhyn here that this should be taken care of by oC as it's also for me the very first time I experience this.

Here's the outpt you asked for:

--- ~ » apt-cache policy libowncloudsync0 owncloud-client owncloud-client-l10n
libowncloudsync0:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
owncloud-client:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
owncloud-client-l10n:
  Installed: 2.2.4-1.1
  Candidate: 2.2.4-1.1
  Version table:
 *** 2.2.4-1.1 500
        500 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10  Packages
        100 /var/lib/dpkg/status
     2.2.2+dfsg-1 500
        500 http://archive.ubuntu.com/ubuntu yakkety/universe amd64 Packages
        500 http://archive.ubuntu.com/ubuntu yakkety/universe i386 Packages
     2.1.1+dfsg-1~bpo8+1 100
        100 http://deb.debian.org/debian jessie-backports/main amd64 Packages
        100 http://deb.debian.org/debian jessie-backports/main i386 Packages

varac on 30 Oct 2016

As a direct feedback, I think it's not very user friendly to point ppl to Ubuntu or OpenSuse, and I agree with @drohhyn here that this should be taken care of by oC as it's also for me the very first time I experience this.

@varac As explained the repository is maintained by opensuse obs (see the opensuse.org in the link) so there is nothing what can be done here from oC side.

If removing and adding the repos is solving this issue then it also shows that this is somehow a limitation of your operating system and not the repositories. This is also nothing what can be solved from oC.

Because of that facts you got pointed to ubuntu/opensuse as not every issue out there can be solved or being taken care of in the scope of ownCloud.

ghost on 30 Oct 2016

So to sum-up there are currently two issues here:

Ubuntu seems to be not able to handle an added repository if an apt-get update is executed before the actual repository key is added. For this a bugreport at https://bugs.launchpad.net/ubuntu/+source/apt needs to be created.
The instructions at https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client is suggesting the wrong steps leading to this issue. This is an auto generated text and that text is out of the control of ownCloud so a new bugreport at https://github.com/openSUSE/software-o-o/issues needs to be created.

ghost on 30 Oct 2016

@guruz From my PoV the "packaging" label and assignment is not needed here for the reasons explained in the last comment above.

ghost on 31 Oct 2016

👍1

@crrodriguez looked into fixing the instructions at https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client any progress here?

jnweiger on 31 Oct 2016

Confirmed @RealRancor s observation:
Ubuntu seems to be not able to handle an added repository if an apt-get update is executed before the actual repository key is added.

It is important to add the repository after the key. This is a bug in 16.10.

I cannot reproduce the issue after the key was once added to the system:
Removing the key, adding the repo, gives the warning as expected. Then re-adding the key while the repo is already there, installation succeeds as expected. :-(

The cause is: Ubuntu forgets to re-scan the repo in the first place. apt-get update says things like: Ign:2 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.10 InRelease
A workaround idea is to find a way how to force a re-scan.

jnweiger on 31 Oct 2016

sudo rm /etc/apt/sources.list.d/owncloud*
sudo apt-key remove 557BEFF9
rm Release.key
sudo apt-get update
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/ /' > /etc/apt/sources.list.d/owncloud-client.list"
wget http://download.opensuse.org/repositories/isv:ownCloud:desktop/Ubuntu_16.04/Release.key
sudo apt-key add - < Release.key
sudo apt-get update
sudo apt-get install owncloud-client

SimonChristopherCropper on 28 Nov 2016

👍4 🎉2 😄1

@SimonChristopherCropper Yes, thats the correct sequence.

From what i can see this bug was reported a few month ago to Ubuntu:

https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1592040

ghost on 28 Nov 2016

I had the same issue on 16.04 and for me it did to just uncomment the line in /etc/apt/sources.list.d/owncloud, do an sudo apt-get update and then to un-uncomment the line again and doing an update again. I obviously already had added the key.