0

I deleted /var/lib/apt and /var/cache/apt because I had weird issues with apt I could not get rid of.

Now I always get:

Get:1 http://security-cdn.debian.org buster/updates InRelease [65.4 kB]
Err:1 http://security-cdn.debian.org buster/updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
Reading package lists... Done
W: GPG error: http://security-cdn.debian.org buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
E: The repository 'http://security.debian.org buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

This is clearly not true. But ok, deleted /etc/apt/trusted.gpg and give it another fresh start:

# rm /etc/apt/trusted.gpg
# apt-key adv --keyserver pgp.mit.edu --recv-keys AA8E81B4331F7F50
Executing: /tmp/apt-key-gpghome.DwxpIbllfu/gpg.1.sh --keyserver pgp.mit.edu --recv-keys AA8E81B4331F7F50
gpg: key EDA0D2388AE22BA9: public key "Debian Security Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
# apt-key adv --keyserver pgp.mit.edu --recv-keys 112695A0E562B32A
Executing: /tmp/apt-key-gpghome.TFiPCm4ThF/gpg.1.sh --keyserver pgp.mit.edu --recv-keys 112695A0E562B32A
gpg: key 4DFAB270CAA96DFA: public key "Debian Security Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
# apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
      6ED6 F5CB 5FA6 FB2F 460A  E88E EDA0 D238 8AE2 2BA9
uid           [ unknown] Debian Security Archive Automatic Signing Key (9/stretch) <ftpmaster@debian.org>
sub   rsa4096 2017-05-22 [S] [expires: 2025-05-20]

pub   rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
      5E61 B217 265D A980 7A23  C5FF 4DFA B270 CAA9 6DFA
uid           [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <ftpmaster@debian.org>
sub   rsa4096 2019-04-14 [S] [expires: 2027-04-12]

# apt update
Get:1 http://security-cdn.debian.org buster/updates InRelease [65.4 kB]
Err:1 http://security-cdn.debian.org buster/updates InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
Reading package lists... Done
W: GPG error: http://security-cdn.debian.org buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY AA8E81B4331F7F50 NO_PUBKEY 112695A0E562B32A
E: The repository 'http://security.debian.org buster/updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Apt just shows message far from reality. It's lying! How can that be?

PS: I should say that I created a backup from /var/lib/apt and /var/apt/cache before I deleted them. When I copy the backup back, no change. So seems something else is broken.

PSS: I also deleted /etc/apt, /var/lib/apt, /var/cache/apt and reinstalled apt via "dpkg -i apt_1.8.2_amd64.deb". All the directories are recreated from scratch but apt update still fails with the same error!

1

In general, it's not a good idea to simply delete system directories. If you need to clean up a package, it's better to purge it and then reinstall it. It's possible you've left your system in a state that can now only be fixed by hand, but I'll try to provide the easiest solution that might work.

To get the proper keys for Debian, you should purge and then reinstall the debian-archive-keyring package. This package provides all of the Debian archive keys in the proper locations and installs them correctly for apt to use. Those keys live in /etc/apt and are required for proper functioning.

| improve this answer | |
  • Well, I didn't do that for fun. The reason is I got the message that that apt could not run as user _apt. 100% of the solutions for this problem was to check all permissions under /var/lib/apt and /var/cache/apt which were 100% writeable by _apt. I saw no other option that starting from scratch. Purging apt on the contrary did not work because it is an essential system package which would break the system. Anyway, everything is working again now – divB Mar 23 at 17:59
  • Do you know why it did NOT work with "apt-key adv --keyserver pgp.mit.edu --recv-keys 112695A0E562B32A"? As I wrote they were listed with "apt-key list". To my knowledge these commands add the keys to /etc/apt/trusted.gpg. When the keys are in /etc/apt/trusted.gpg.d/ (as provided by debian-archive-keyring package) it worked. I don't understand why ... – divB Mar 23 at 18:02
  • I don't know why importing the keys directly didn't work. apt is not Essential: yes on Debian, although apt itself will complain if you try to remove it. It should be removable and reinstallable with dpkg. – bk2204 Mar 23 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.