GPG error and authentication warning when adding the medibuntu repository

[wim007]

I just installed Kubuntu 9.10 Karmic Koala. I want to add the Medibuntu repository to install Skype. So I followed the instructions on https://help.ubuntu.com/community/Me...e%20Repository

But in the output of that command I got the following errors and warnings:
W: GPG error: http://packages.medibuntu.org karmic Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 2EBC26B60C5A2783
(...)
WARNING: The following packages cannot be authenticated!
medibuntu-keyring
Authentication warning overridden.

This doesn't give me a secure feeling....

Can you explain me what the possible security implications these errors and warnings can have?
What should I do now? How can I make my system secure agian / how can I add the medibutnu repository in a secure way?

Thnx,

Wim

[kubicle]

Re: GPG error and authentication warning when adding the medibuntu repository

GPG keys are used to verify the authenticity of the downloaded packages that are going to be installed. Usually this is a good idea to ensure that the packages have not been tampered with.

Unfortunately the key for medibuntu is in the 'medibuntu-keyring' package, which you have to install (without verification), unless you want to install the required key manually.

Sort of the chicken-and-the-egg situation, you need to install medibuntu-keyring to validate the packages from medibuntu (including medibuntu-keyring).

Once you've installed medibuntu-keyring, you shouldn't recieve anymore warnings (unless the gpg check fails of course)

[wim007]

Re: GPG error and authentication warning when adding the medibuntu repository

Thnx 4 the information Kubicle!

I've got another computer where I want to install Kubuntu 9.10 Karmic Koala on. There I want to install the GPG key in a safe way.

I've searched the internet to learn how to install the GPG key manually. I've found three options. They are almost the same, except for a space and/or a minus character.
wget -q http://packages.medibuntu.org/medibuntu-key.gpg -O - | sudo apt-key add - && sudo apt-get update
wget -q http://packages.medibuntu.org/medibuntu-key.gpg -O- | sudo apt-key add - && sudo apt-get update
wget -q http://packages.medibuntu.org/medibuntu-key.gpg -O | sudo apt-key add - && sudo apt-get update

I got this information from forums, so I'm not what I can trust. Also the url to the key is http:// instead of https://. That doesn't feel to safe for me.

Can you please tell me where I can find how to install the GPG key manually in a safe way?
What is the url to the medibuntu-key.gpg on a secured connection to medibuntu.org (https://*medibuntu.org/*medibuntu-key.gpg)?

[Snowhog]

Re: GPG error and authentication warning when adding the medibuntu repository

The methods are safe. Medibuntu doesn't run an https:// site.

[vinnywright]

Re: GPG error and authentication warning when adding the medibuntu repository

this ia a nice one time copy and paste to do what you want

sudo wget http://www.medibuntu.org/sources.list.d/`lsb_release -cs`.list --output-document=/etc/apt/sources.list.d/medibuntu.list; sudo apt-get -q update; sudo apt-get --yes -q --allow-unauthenticated install medibuntu-keyring; sudo apt-get -q update

VINNY

[kubicle]

Re: GPG error and authentication warning when adding the medibuntu repository

Key security isn't IMO something to be overly cautious about (although installing the keys is still recommended).

IMO, using a 3rd party repository in itself is a bigger risk than some sort of advanced man-in-the-middle-key-forgery during the key transaction (copy via normal http protocol).

[Duke_Zuper]

Re: GPG error and authentication warning when adding the medibuntu repository

Hi.
Am I doing something wrong here? I've tried 3 or more times and still get the same error message code.

E: Type '[...]' is not known on line 55 in source list /etc/apt/sources.list

I'm running 9.10 updated the system software, but unless I'm not understanding something I can't download Medibuntu repository.

I first followed this link:
http://www.howtoforge.com/the-perfec...ubuntu-9.10-p2

then went to this link:
https://help.ubuntu.com/community/Medibuntu

then found this thread.

Could someone please explain this to me?

Thanks.

[Snowhog]

Re: GPG error and authentication warning when adding the medibuntu repository

Show us your /etc/apt/sources.list file. Line 55 is 'mal-formed.' We can tell you what to do if we see what it looks like.

[Snowhog]

Re: GPG error and authentication warning when adding the medibuntu repository

Easiest way: Press Alt+F2 and type kate /etc/apt/sources.list and when the file is open, press Ctrl+C to copy the entire file. Now you can 'paste' the contents into your reply here.

[Duke_Zuper]

Re: GPG error and authentication warning when adding the medibuntu repository

I did exactly what you said. Nothing happened. Nothing was retrieved rather.

[verndog]

Re: GPG error and authentication warning when adding the medibuntu repository

I did exactly what you said. Nothing happened. Nothing was retrieved rather.

You must have something wrong. Repositories should be there.

From a terminal does the output of 'ls -l /etc/apt/sources.list' show any length?

[Snowhog]

Re: GPG error and authentication warning when adding the medibuntu repository

I did exactly what you said. Nothing happened. Nothing was retrieved rather.

The file has to be there, as in your previous post, you showed us:

E: Type '[...]' is not known on line 55 in source list /etc/apt/sources.list

When you say 'nothing happened' - what exactly do you mean? Did Kate launch? If it did, then check your spelling.

[Duke_Zuper]

Re: GPG error and authentication warning when adding the medibuntu repository

Sorry, my mistake; I didn't recognize the space after the word "kate".

Here is what I have:

#deb cdrom:[Kubuntu 9.10 _Karmic Koala_ - Release amd64 (20091027)]/ karmic main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.

deb http://us.archive.ubuntu.com/ubuntu/ karmic main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ karmic-updates main restricted
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ karmic universe
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic universe
deb http://us.archive.ubuntu.com/ubuntu/ karmic-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ karmic multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic multiverse
deb http://us.archive.ubuntu.com/ubuntu/ karmic-updates multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ karmic-updates multiverse

## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb http://us.archive.ubuntu.com/ubuntu/ karmic-backports main restricted universe multiverse
# deb-src http://us.archive.ubuntu.com/ubuntu/ karmic-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu karmic partner
# deb-src http://archive.canonical.com/ubuntu karmic partner

deb http://security.ubuntu.com/ubuntu karmic-security main restricted
deb-src http://security.ubuntu.com/ubuntu karmic-security main restricted
deb http://security.ubuntu.com/ubuntu karmic-security universe
deb-src http://security.ubuntu.com/ubuntu karmic-security universe
deb http://security.ubuntu.com/ubuntu karmic-security multiverse
deb-src http://security.ubuntu.com/ubuntu karmic-security multiverse

[...]
## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
deb http://archive.canonical.com/ubuntu karmic partner
deb-src http://archive.canonical.com/ubuntu karmic partner
[...]

[Duke_Zuper]

Re: GPG error and authentication warning when adding the medibuntu repository

I think I just figured it out.. I should probably take out the "[...]" shouldn't I? (duh!!)

Thanks y'all!!

[Snowhog]

Re: GPG error and authentication warning when adding the medibuntu repository

The lines containing [...] are causing the problems. You need to remove those two lines. To do so, you have to edit the file 'as root.' To do this:

Alt+F2 and then type: kdesu kate /etc/apt/sources.list The file will be opened in Kate 'as root' and you can then remove those two lines, save and exit kate.