Bonjour,
j'ai constat=E9 depuis quelques temps (passage de sarge =E0 etch) que aptitu=
de me=20
renvoyait des messages du type:
W: GPG error: http://ftp2.fr.debian.org testing Release: Les signatures=20
suivantes n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas=20
disponible=A0: NO_PUBKEY 010908312D230C5F
W: GPG error: http://ftp.oleane.net testing Release: Les signatures suivante=
s=20
n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=
=A0:=20
NO_PUBKEY BB5E459A529B8BDA
W: GPG error: ftp://ftp.nerim.net etch Release: Les signatures suivantes n'o=
nt=20
pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=A0: N=
O_PUBKEY=20
07DC563D1F41B907
W: GPG error: http://www.stanchina.net ./ Release: Les signatures suivantes=20
n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=
=A0:=20
NO_PUBKEY 3DCCCCACE46F104F
Par ailleurs si je mets =E0 jour mon installation, aptitude me renvoi des=20
messages du type:
ATTENTION : des versions non certifi=E9es des paquets qui suivent vont =EAtr=
e=20
install=E9es.
Des paquets non certifi=E9s peuvent compromettre la s=E9curit=E9 de votre sy=
st=E8me.=20
Vous ne devez poursuivre leur installation que si vous =EAtes certain de ce=20=
que=20
vous faites.
* sane-utils [version 1.0.17-1]
.....(suit la liste des paquets "non certifi=E9s")
Pensant corriger le probl=E8me j'ai (en r=E9sum=E9) install=E9 le script de=20=
Anthony=20
Towns (apt-check-signs) et install=E9 les parties publiques des cl=E9s (cf.=20=
le=20
livre sur Debian de Hertzog, V=E9rification d'authenticit=E9 des paquets, p.=
85).
Malheureusement si je fais
apt-get update
apt-check-sigs
j'obtiens respectivement
Everest:/home/fred# apt-get update
R=E9ception de=A0: 1 http://ftp2.fr.debian.org testing Release.gpg [378B]
Atteint http://ftp2.fr.debian.org testing Release
R=E9ception de=A0: 2 ftp://ftp.nerim.net etch Release.gpg [189B]
R=E9ception de=A0: 3 http://ftp.oleane.net testing Release.gpg [189B]
Atteint http://ftp.oleane.net testing Release
R=E9ception de=A0: 4 http://security.debian.org testing/updates Release.gpg=20=
[189B]
Ign http://ftp2.fr.debian.org testing Release
Ign http://ftp.oleane.net testing Release
Atteint ftp://ftp.nerim.net etch Release
Ign ftp://ftp.nerim.net etch Release
Atteint http://ftp2.fr.debian.org testing/main Packages
Atteint http://ftp.oleane.net testing/non-free Packages
Atteint http://ftp2.fr.debian.org testing/main Sources
Atteint ftp://ftp.nerim.net etch/main Packages
Atteint http://security.debian.org testing/updates Release
Ign http://security.debian.org testing/updates/main Packages
Atteint http://security.debian.org testing/updates/main Packages
R=E9ception de=A0: 5 http://www.stanchina.net ./ Release.gpg [189B]
Atteint http://www.stanchina.net ./ Release
Ign http://www.stanchina.net ./ Release
Atteint http://www.stanchina.net ./ Packages
946o r=E9ceptionn=E9s en 1s (559o/s)
Lecture des listes de paquets... Fait
W: GPG error: http://ftp2.fr.debian.org testing Release: Les signatures=20
suivantes n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas=20
disponible=A0: NO_PUBKEY 010908312D230C5F
W: GPG error: http://ftp.oleane.net testing Release: Les signatures suivante=
s=20
n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=
=A0:=20
NO_PUBKEY BB5E459A529B8BDA
W: GPG error: ftp://ftp.nerim.net etch Release: Les signatures suivantes n'o=
nt=20
pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=A0: N=
O_PUBKEY=20
07DC563D1F41B907
W: GPG error: http://www.stanchina.net ./ Release: Les signatures suivantes=20
n'ont pas pu =EAtre v=E9rifi=E9es car la cl=E9 publique n'est pas disponible=
=A0:=20
NO_PUBKEY 3DCCCCACE46F104F
W: Vous pouvez lancer =AB=A0apt-get update=A0=BB pour corriger ces probl=E8m=
es.
et
Everest:~/apt-check-sigs# ./apt-check-sigs
Checking sources in /etc/apt/sources.list:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You should take care to ensure that the distributions you're downloading
are the ones you think you are downloading, and that they are as up to
date as you would expect (testing and unstable should be no more than
two or three days out of date, stable-updates no more than a few weeks
or a month).
Source: deb http://ftp2.fr.debian.org/debian/ testing main
o Origin: Debian/Debian
o Suite: testing/etch
o Date: Sun, 15 Jan 2006 21:21:43 UTC
o Description: Debian Testing distribution - Not Released
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
Source: deb-src http://ftp2.fr.debian.org/debian/ testing main
o Origin: Debian/Debian
o Suite: testing/etch
o Date: Sun, 15 Jan 2006 21:21:43 UTC
o Description: Debian Testing distribution - Not Released
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F
* NO VALID SIGNATURE
* PROBLEMS WITH component main (OK, NOCHECK)
Source: deb http://security.debian.org/ testing/updates main
o Origin: Debian/Debian-Security
o Suite: testing/etch
o Date: Mon, 16 Jan 2006 15:16:00 UTC
o Description: Debian testing Security Updates
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
Source: deb http://www.stanchina.net/~flavio/debian-fglrx-xfree86/ ./
* NO TOP-LEVEL Release FILE
Source: deb http://ftp.oleane.net/pub/java-linux/debian/ testing non-free
o Origin: Blackdown Java-Linux/blackdown
o Suite: testing/etch
o Date: Tue, 29 Nov 2005 19:50:09 +0000
o Description: Blackdown deb archive
* COULDN'T CHECK SIGNATURE BY KEYID: BB5E459A529B8BDA
* NO VALID SIGNATURE
* PROBLEMS WITH non-free (OK, NOCHECK)
Source: deb ftp://ftp.nerim.net/debian-marillat/ etch main
o Origin: Unofficial Multimedia Packages/Unofficial Multimedia Packages
o Suite: testing/etch
o Date: Mon, 16 Jan 2006 12:54:56 UTC
o Description: This repository is mostly non-free
* COULDN'T CHECK SIGNATURE BY KEYID: 07DC563D1F41B907
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
Results
~~~~~~~
find: AVERTISSEMENT: vous avez sp=E9cifi=E9 l'option -maxdepth apr=E8s un ar=
gument=20
qui n'est pas une option -type mais les options sont positionnelles=20
(-maxdepth affecte les tests sp=E9cifi=E9s avant aussi bien qu'apr=E8s)
The following files in /var/lib/apt/lists have not been validated.
This could turn out to be a harmless indication that this script is buggy
or out of date, or it could let trojaned packages get onto your system.
The contents of the following files in /var/lib/apt/lists could not be
validated due to the lack of a signed Release file, or the lack of an
appropriate entry in a signed Release file. This probably means that the
maintainers of these sources are slack, but may mean these sources are
being actively used to distribute trojans. The files have been renamed
to have the extension .FAILED and will be ignored by apt.
Checking sources in /etc/apt/sources.list: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You should take care to ensure that the distributions you're downloading are the ones you think you are downloading, and that they are as up to date as you would expect (testing and unstable should be no more than two or three days out of date, stable-updates no more than a few weeks or a month).
Source: deb http://ftp2.fr.debian.org/debian/ testing main o Origin: Debian/Debian o Suite: testing/etch o Date: Sun, 15 Jan 2006 21:21:43 UTC o Description: Debian Testing distribution - Not Released * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
Source: deb-src http://ftp2.fr.debian.org/debian/ testing main o Origin: Debian/Debian o Suite: testing/etch o Date: Sun, 15 Jan 2006 21:21:43 UTC o Description: Debian Testing distribution - Not Released * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F * NO VALID SIGNATURE * PROBLEMS WITH component main (OK, NOCHECK)
Source: deb http://security.debian.org/ testing/updates main o Origin: Debian/Debian-Security o Suite: testing/etch o Date: Mon, 16 Jan 2006 15:16:00 UTC o Description: Debian testing Security Updates * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
Source: deb http://www.stanchina.net/~flavio/debian-fglrx-xfree86/ ./ * NO TOP-LEVEL Release FILE
Source: deb http://ftp.oleane.net/pub/java-linux/debian/ testing non-free o Origin: Blackdown Java-Linux/blackdown o Suite: testing/etch o Date: Tue, 29 Nov 2005 19:50:09 +0000 o Description: Blackdown deb archive * COULDN'T CHECK SIGNATURE BY KEYID: BB5E459A529B8BDA * NO VALID SIGNATURE * PROBLEMS WITH non-free (OK, NOCHECK)
Source: deb ftp://ftp.nerim.net/debian-marillat/ etch main o Origin: Unofficial Multimedia Packages/Unofficial Multimedia Packages o Suite: testing/etch o Date: Mon, 16 Jan 2006 12:54:56 UTC o Description: This repository is mostly non-free * COULDN'T CHECK SIGNATURE BY KEYID: 07DC563D1F41B907 * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
The following files in /var/lib/apt/lists have not been validated. This could turn out to be a harmless indication that this script is buggy or out of date, or it could let trojaned packages get onto your system.
The contents of the following files in /var/lib/apt/lists could not be validated due to the lack of a signed Release file, or the lack of an appropriate entry in a signed Release file. This probably means that the maintainers of these sources are slack, but may mean these sources are being actively used to distribute trojans. The files have been renamed to have the extension .FAILED and will be ignored by apt.
Checking sources in /etc/apt/sources.list:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You should take care to ensure that the distributions you're downloading
are the ones you think you are downloading, and that they are as up to
date as you would expect (testing and unstable should be no more than
two or three days out of date, stable-updates no more than a few weeks
or a month).
Source: deb http://ftp2.fr.debian.org/debian/ testing main
o Origin: Debian/Debian
o Suite: testing/etch
o Date: Sun, 15 Jan 2006 21:21:43 UTC
o Description: Debian Testing distribution - Not Released
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
Source: deb-src http://ftp2.fr.debian.org/debian/ testing main
o Origin: Debian/Debian
o Suite: testing/etch
o Date: Sun, 15 Jan 2006 21:21:43 UTC
o Description: Debian Testing distribution - Not Released
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F
* NO VALID SIGNATURE
* PROBLEMS WITH component main (OK, NOCHECK)
Source: deb http://security.debian.org/ testing/updates main
o Origin: Debian/Debian-Security
o Suite: testing/etch
o Date: Mon, 16 Jan 2006 15:16:00 UTC
o Description: Debian testing Security Updates
* COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
Source: deb http://www.stanchina.net/~flavio/debian-fglrx-xfree86/ ./
* NO TOP-LEVEL Release FILE
Source: deb http://ftp.oleane.net/pub/java-linux/debian/ testing non-free
o Origin: Blackdown Java-Linux/blackdown
o Suite: testing/etch
o Date: Tue, 29 Nov 2005 19:50:09 +0000
o Description: Blackdown deb archive
* COULDN'T CHECK SIGNATURE BY KEYID: BB5E459A529B8BDA
* NO VALID SIGNATURE
* PROBLEMS WITH non-free (OK, NOCHECK)
Source: deb ftp://ftp.nerim.net/debian-marillat/ etch main
o Origin: Unofficial Multimedia Packages/Unofficial Multimedia Packages
o Suite: testing/etch
o Date: Mon, 16 Jan 2006 12:54:56 UTC
o Description: This repository is mostly non-free
* COULDN'T CHECK SIGNATURE BY KEYID: 07DC563D1F41B907
* NO VALID SIGNATURE
* PROBLEMS WITH main (OK, NOCHECK)
The following files in /var/lib/apt/lists have not been validated.
This could turn out to be a harmless indication that this script is buggy
or out of date, or it could let trojaned packages get onto your system.
The contents of the following files in /var/lib/apt/lists could not be
validated due to the lack of a signed Release file, or the lack of an
appropriate entry in a signed Release file. This probably means that the
maintainers of these sources are slack, but may mean these sources are
being actively used to distribute trojans. The files have been renamed
to have the extension .FAILED and will be ignored by apt.
Checking sources in /etc/apt/sources.list: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You should take care to ensure that the distributions you're downloading are the ones you think you are downloading, and that they are as up to date as you would expect (testing and unstable should be no more than two or three days out of date, stable-updates no more than a few weeks or a month).
Source: deb http://ftp2.fr.debian.org/debian/ testing main o Origin: Debian/Debian o Suite: testing/etch o Date: Sun, 15 Jan 2006 21:21:43 UTC o Description: Debian Testing distribution - Not Released * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
Source: deb-src http://ftp2.fr.debian.org/debian/ testing main o Origin: Debian/Debian o Suite: testing/etch o Date: Sun, 15 Jan 2006 21:21:43 UTC o Description: Debian Testing distribution - Not Released * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * COULDN'T CHECK SIGNATURE BY KEYID: 010908312D230C5F * NO VALID SIGNATURE * PROBLEMS WITH component main (OK, NOCHECK)
Source: deb http://security.debian.org/ testing/updates main o Origin: Debian/Debian-Security o Suite: testing/etch o Date: Mon, 16 Jan 2006 15:16:00 UTC o Description: Debian testing Security Updates * COULDN'T CHECK SIGNATURE BY KEYID: F1D53D8C4F368D5D * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
Source: deb http://www.stanchina.net/~flavio/debian-fglrx-xfree86/ ./ * NO TOP-LEVEL Release FILE
Source: deb http://ftp.oleane.net/pub/java-linux/debian/ testing non-free o Origin: Blackdown Java-Linux/blackdown o Suite: testing/etch o Date: Tue, 29 Nov 2005 19:50:09 +0000 o Description: Blackdown deb archive * COULDN'T CHECK SIGNATURE BY KEYID: BB5E459A529B8BDA * NO VALID SIGNATURE * PROBLEMS WITH non-free (OK, NOCHECK)
Source: deb ftp://ftp.nerim.net/debian-marillat/ etch main o Origin: Unofficial Multimedia Packages/Unofficial Multimedia Packages o Suite: testing/etch o Date: Mon, 16 Jan 2006 12:54:56 UTC o Description: This repository is mostly non-free * COULDN'T CHECK SIGNATURE BY KEYID: 07DC563D1F41B907 * NO VALID SIGNATURE * PROBLEMS WITH main (OK, NOCHECK)
The following files in /var/lib/apt/lists have not been validated. This could turn out to be a harmless indication that this script is buggy or out of date, or it could let trojaned packages get onto your system.
The contents of the following files in /var/lib/apt/lists could not be validated due to the lack of a signed Release file, or the lack of an appropriate entry in a signed Release file. This probably means that the maintainers of these sources are slack, but may mean these sources are being actively used to distribute trojans. The files have been renamed to have the extension .FAILED and will be ignored by apt.
