Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have mirrored the Ubuntu archive repository (I must say it's rather huge). Then, I can apt-get install with no problem, but it prompts with following warning:

WARNING: The following packages cannot be authenticated!
  xxxx, xxxx, ...
Install these packages without verification [y/N]? 

Well, you can always install it.

But, I can't install from the Ubuntu software GUI. Which require trusted source.


  1. How to force the GUI to install untrusted package?
  2. Should I configure GPG to receive some public keys? (I've already installed ubuntu-keyring, debian-keyring, but it still untrusted)
  3. Should I configure GPG to receive unknown keys from some specific keyservers, automatically?
share|improve this question
up vote 1 down vote accepted

The problem could be that you don't have the repository's key on your apt keyring, as Badger says, but I think this is unlikely. If it truly is a mirror of the Ubuntu repo, then it will be using the same key, and you should already have the necessary keys. (I assume you don't get this error when you use one of the standard mirrors.)

So that means your mirror probably isn't signed properly, which could be because you didn't mirror it the right way. There's a particular sequence you need to use, to avoid getting an inconsistent copy if a repo update takes place while you are copying. Given how long it takes, this is quite likely, especially on the initial copy rather than a refresh. The Debian Push Mirroring web page explains how to do it with everyday tools like rsync, but it's still better to use a dedicated tool like apt-mirror.

The way repo signing works is that there's a top-level Release file in the dist directory (eg dists/lucid) which is signed (Release.gpg). This contains hashes of all the other index files (eg main/binary-i386/Packages) which in turn contain hashes of the package file themselves. So if any of the hashes are out of date, the whole repo verification fails. Debian Secure Apt explains the details.

share|improve this answer

You might want to look at this website:

When you update you might get something like this:

W: GPG error: file: edgy-plf Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F120156012B83718
W: GPG error: file: edgy Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 31A5F97FED8A569E
W: GPG error: file: edgy Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 18B52FE3521A9C7C

You want to use those keys and do this for each of them:

sudo gpg --keyserver --recv F120156012B83718
sudo gpg --export --armor F120156012B83718 | sudo apt-key add -

I only skimmed the article but I am fairly sure this is what you need

share|improve this answer

You could also consider using a caching apt proxy (eg approx) instead of a full mirror. This fetches packages as you need them, and saves them for future re-use, either on the same machine or a different one. It's rare that anyone actually needs a full mirror, and it takes a lot of bandwidth to keep it up to date, most of which will be for packages that you will never use.

share|improve this answer
Well the proxy server doesn't help for me. In China, the connection to America is rather slow, and I just can't wait tons of hour to just download something for the first time, this is why I mirror the Ubunto repo, because I can let the mirror downloading everything when I'm sleeping. And one day when I want to install something, it's just there, just in my local USB box, I hate waiting. – Xiè Jìléi Jul 10 '10 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .